0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955

General

Target

0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Size

283KB
MD5

9eff4dc732c8793104cf8d670b81da80
SHA1

7b76201b0f57de97706a32931e0a7916e5bf4b8c
SHA256

0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955
SHA512

b96c9e68085fde13bfcc77fe879177a4a34e0267ea20e28554e28275066d188384d9e503687516e51513d81284005258dfcc77749e725f3ac40afd1a17f310c2
SSDEEP

6144:MCSTrIE3jL7cIFbqQPCLheqvJ8iDBvn4nK6MRSlLO+bL:bmjLtBXUheqvGiFv4nK6ASE+H

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2804 set thread context of 4792	2804	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe	81

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\S7.Document\shell\open\command	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\S7.Document\shell\print\command	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.q\ = "S7.Document"	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\S7.Document	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\S7.Document\shell	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\S7.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0FE398~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\""	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.q	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\S7.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0FE398~1.EXE,0"	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\S7.Document\DefaultIcon	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\S7.Document\shell\open	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\S7.Document\shell\printto\command	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.q\ShellNew\NullFile	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\S7.Document\ = "S7 Document"	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\S7.Document\shell\print	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\S7.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0FE398~1.EXE /p \"%1\""	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\S7.Document\shell\printto	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.q\ShellNew	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\S7.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0FE398~1.EXE \"%1\""	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2804	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
2804	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2804	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
2804	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 4792	2804	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe	81
PID 2804 wrote to memory of 4792	2804	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe	81
PID 2804 wrote to memory of 4792	2804	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe	81
PID 2804 wrote to memory of 4792	2804	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe	81
PID 2804 wrote to memory of 4792	2804	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe	81
PID 2804 wrote to memory of 4792	2804	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe	81
PID 2804 wrote to memory of 4792	2804	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe	81
PID 2804 wrote to memory of 4792	2804	0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe	81

C:\Users\Admin\AppData\Local\Temp\0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
"C:\Users\Admin\AppData\Local\Temp\0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Users\Admin\AppData\Local\Temp\0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
  C:\Users\Admin\AppData\Local\Temp\0fe398a85a1023353bd221c6089ac7f79dc4dc7a6647ba089662de5387f4a955.exe
  2⤵
  PID:4792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2804-135-0x0000000000A80000-0x0000000000A84000-memory.dmp

Filesize
16KB

Download
memory/4792-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4792-136-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing