Analysis
-
max time kernel
170s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 15:27
Static task
static1
Behavioral task
behavioral1
Sample
a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe
-
Size
4.2MB
-
MD5
910a29038dd9bbd6787f67ddee00aa93
-
SHA1
a0fcb070f98fe67c35ad91d814763144b3887274
-
SHA256
a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f
-
SHA512
0172235837157c55c53aba84497cc8c3b590ac2fec947cb95baf0bb103ce3a7e25992e2de3fdaac155408f51db022a3e66a945c884041e568ecdcf6378df4b67
-
SSDEEP
98304:okd493VYdvFKfX9uedSGClIbCYmfwBpCmkoG3+IWuloOdv7r/T:cKv4/9JClBfeqr3tr5nb
Score
7/10
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe -
Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe 1036 a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe"C:\Users\Admin\AppData\Local\Temp\a5d6556c233c08fbc5174de4436e3d63549f4552e541726deb906b6dca7e404f.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1036