Analysis
-
max time kernel
174s -
max time network
103s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 14:30
Static task
static1
Behavioral task
behavioral1
Sample
b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe
-
Size
91KB
-
MD5
fba2ad94c15b6cb975bee8bc06c07e9c
-
SHA1
37e56ac94c26be2bbc24ed61d5c63f59ac1e5e53
-
SHA256
b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670
-
SHA512
f1371ee7ee230ffd37db9d553255c483f3ac1f7fb0b540a51df2e07740f0153e4139aaa3a95be6779830d0e350575bfa04552b36e78c967f981b441f2181893e
-
SSDEEP
1536:91zq+5hRpfvo7IiQJ/nLl4KsWc677OLV9ocN0MAreptlMJoY/YYx24YGDn898q/5:xiQxnR4KsNh420preZMJvnYGQK+kV1uv
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "c:\\users\\admin\\appdata\\local\\temp\\b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe" b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1164 set thread context of 1484 1164 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 28 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 1484 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1164 wrote to memory of 1484 1164 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 28 PID 1164 wrote to memory of 1484 1164 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 28 PID 1164 wrote to memory of 1484 1164 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 28 PID 1164 wrote to memory of 1484 1164 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 28 PID 1164 wrote to memory of 1484 1164 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 28 PID 1164 wrote to memory of 1484 1164 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 28 PID 1164 wrote to memory of 1484 1164 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 28 PID 1164 wrote to memory of 1484 1164 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe"C:\Users\Admin\AppData\Local\Temp\b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\users\admin\appdata\local\temp\b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe"c:\users\admin\appdata\local\temp\b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe"2⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1484
-