Analysis
-
max time kernel
188s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 08:32
Static task
static1
Behavioral task
behavioral1
Sample
6794c4362a7aa4147763669c9ce720453be48e3ee873364bd50887fbdfd015cf.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6794c4362a7aa4147763669c9ce720453be48e3ee873364bd50887fbdfd015cf.exe
Resource
win10v2004-20221111-en
General
-
Target
6794c4362a7aa4147763669c9ce720453be48e3ee873364bd50887fbdfd015cf.exe
-
Size
8.4MB
-
MD5
aa0245885db76875b9d6f5848bc0aabd
-
SHA1
ee085601f14a891faebc797cc687e136c8998752
-
SHA256
6794c4362a7aa4147763669c9ce720453be48e3ee873364bd50887fbdfd015cf
-
SHA512
74be3959e20a4b7da8f793db0c86ba028646307dbdbd3bec51625c267965016fb66ef0af3cc87faa9888b8c4edef7f5ec2b7ddd0c62fe30628733f5a65cc0471
-
SSDEEP
196608:EUQzUQLx4q9fa/NSIonoAJCu2ZwHZ7JLtoLmOkCKnpd2Cj:5KLx0HvAJiZO7ttoLmOkL2s
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5092 6794c4362a7aa4147763669c9ce720453be48e3ee873364bd50887fbdfd015cf.exe 5092 6794c4362a7aa4147763669c9ce720453be48e3ee873364bd50887fbdfd015cf.exe 5092 6794c4362a7aa4147763669c9ce720453be48e3ee873364bd50887fbdfd015cf.exe 5092 6794c4362a7aa4147763669c9ce720453be48e3ee873364bd50887fbdfd015cf.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5092 6794c4362a7aa4147763669c9ce720453be48e3ee873364bd50887fbdfd015cf.exe 5092 6794c4362a7aa4147763669c9ce720453be48e3ee873364bd50887fbdfd015cf.exe 5092 6794c4362a7aa4147763669c9ce720453be48e3ee873364bd50887fbdfd015cf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6794c4362a7aa4147763669c9ce720453be48e3ee873364bd50887fbdfd015cf.exe"C:\Users\Admin\AppData\Local\Temp\6794c4362a7aa4147763669c9ce720453be48e3ee873364bd50887fbdfd015cf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5092