b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec

Analysis

max time kernel
18s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
Size

2.4MB
MD5

5135a486713c7f5e50da6c7f6085c25b
SHA1

6769d471893c014cc962be080b7c79af062be01c
SHA256

b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec
SHA512

0c1ca363493c8d874677fca3fa3968bfc5a3dd09a08466fbcc5d92b30af8f43da583a9f39d7c1837b2d566b2ab069538ef24426d328184686437c8774036aa65
SSDEEP

49152:BFJeyXLDWGuXXITQTa/HgKKaudym7OuoJMcwq:PcwLDWGmX8o2HgEMcwq

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts2	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
1968	b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe

C:\Users\Admin\AppData\Local\Temp\b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe
"C:\Users\Admin\AppData\Local\Temp\b2a9792a161d3d91092fcd5c29ae3e703d0116f51f99c6b06970996dd5f653ec.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download