Analysis
-
max time kernel
195s -
max time network
205s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28/11/2022, 04:19
Static task
static1
Behavioral task
behavioral1
Sample
87103f9b2eb12a231e33d9a4b11c62dcc28f111d7094f7ede31336eced25ccdf.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
87103f9b2eb12a231e33d9a4b11c62dcc28f111d7094f7ede31336eced25ccdf.exe
Resource
win10v2004-20220812-en
General
-
Target
87103f9b2eb12a231e33d9a4b11c62dcc28f111d7094f7ede31336eced25ccdf.exe
-
Size
100KB
-
MD5
fdd719510efc05d71e8df70b516e6e88
-
SHA1
160a95e7ca84255a61fc4a20038e1f8a9ca89748
-
SHA256
87103f9b2eb12a231e33d9a4b11c62dcc28f111d7094f7ede31336eced25ccdf
-
SHA512
31eb6c646ece6b9d9c9e9190763c7b087ea1b4473711e7c9af87646cb5e7d7a0e78c937c07cca47e17c88e8b6aa3131426edca362ff89a1e187f7414dcf59d18
-
SSDEEP
1536:v2On8laZrWz/TnOKDMuYEdOWfBtidfAVmSpREV14cjNid:v2OnWTpDMNYBBuARpRQ13Nid
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuaesldx = "\"C:\\Users\\Admin\\AppData\\Local\\afqhpwhf.exe\"" svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1304 87103f9b2eb12a231e33d9a4b11c62dcc28f111d7094f7ede31336eced25ccdf.exe 1304 87103f9b2eb12a231e33d9a4b11c62dcc28f111d7094f7ede31336eced25ccdf.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1304 wrote to memory of 468 1304 87103f9b2eb12a231e33d9a4b11c62dcc28f111d7094f7ede31336eced25ccdf.exe 27 PID 1304 wrote to memory of 468 1304 87103f9b2eb12a231e33d9a4b11c62dcc28f111d7094f7ede31336eced25ccdf.exe 27 PID 1304 wrote to memory of 468 1304 87103f9b2eb12a231e33d9a4b11c62dcc28f111d7094f7ede31336eced25ccdf.exe 27 PID 1304 wrote to memory of 468 1304 87103f9b2eb12a231e33d9a4b11c62dcc28f111d7094f7ede31336eced25ccdf.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\87103f9b2eb12a231e33d9a4b11c62dcc28f111d7094f7ede31336eced25ccdf.exe"C:\Users\Admin\AppData\Local\Temp\87103f9b2eb12a231e33d9a4b11c62dcc28f111d7094f7ede31336eced25ccdf.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Adds Run key to start application
PID:468
-