e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340

Analysis

max time kernel
189s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Size

3.7MB
MD5

4673cf861f71f6e89e721942013982c9
SHA1

38a84036bec53538c950da920a87e41696b4a431
SHA256

e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340
SHA512

2ffadc5f7f58a93629f30c54f64d06e32bfde3a7f507a30d9fa85caa708dd0206c8d214c2192d9d9cbd71747e7789f5dfdd6e460b3459cc61d4b45e5b45d7e0d
SSDEEP

49152:dFd/+G0DP6GVCtvRTHOXwBjPTfk8ut3wjnmG6H3FGnQbl6PlUBYprETj3k:xWP6GwtpygNTfk59wLbYonkl6PlUBYi

Score

1^/10

Malware Config

Signatures

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xiao.Document\shell\print\command	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xiao.Document\shell\printto\command	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xiao.Document\shell\printto	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pli\ = "xiao.Document"	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xiao.Document	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xiao.Document\AppUserModelID = "xiao.AppID.NoVersion"	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xiao.Document\shell\open\command	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xiao.Document\shell	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xiao.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E51A5F~1.EXE /p \"%1\""	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xiao.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E51A5F~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\""	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xiao.Document\ = "xiao.Document"	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xiao.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E51A5F~1.EXE,1"	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xiao.Document\shell\open	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xiao.Document\shell\print	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xiao.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E51A5F~1.EXE \"%1\""	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pli	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pli\ShellNew\NullFile	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xiao.Document\DefaultIcon	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pli\ShellNew	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1516	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1516	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1516	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
1516	e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe

C:\Users\Admin\AppData\Local\Temp\e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe
"C:\Users\Admin\AppData\Local\Temp\e51a5f57b6eb7e8919b218f3fe982214d49069ff5fe2900c6b48d07965ecc340.exe"
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1516-55-0x000000000066B000-0x0000000000690000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads