Analysis
-
max time kernel
187s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 14:30
Static task
static1
Behavioral task
behavioral1
Sample
b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe
-
Size
91KB
-
MD5
fba2ad94c15b6cb975bee8bc06c07e9c
-
SHA1
37e56ac94c26be2bbc24ed61d5c63f59ac1e5e53
-
SHA256
b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670
-
SHA512
f1371ee7ee230ffd37db9d553255c483f3ac1f7fb0b540a51df2e07740f0153e4139aaa3a95be6779830d0e350575bfa04552b36e78c967f981b441f2181893e
-
SSDEEP
1536:91zq+5hRpfvo7IiQJ/nLl4KsWc677OLV9ocN0MAreptlMJoY/YYx24YGDn898q/5:xiQxnR4KsNh420preZMJvnYGQK+kV1uv
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "c:\\users\\admin\\appdata\\local\\temp\\b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe" b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3492 set thread context of 3664 3492 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 83 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 3664 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3492 wrote to memory of 3664 3492 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 83 PID 3492 wrote to memory of 3664 3492 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 83 PID 3492 wrote to memory of 3664 3492 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 83 PID 3492 wrote to memory of 3664 3492 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 83 PID 3492 wrote to memory of 3664 3492 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 83 PID 3492 wrote to memory of 3664 3492 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 83 PID 3492 wrote to memory of 3664 3492 b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe"C:\Users\Admin\AppData\Local\Temp\b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\users\admin\appdata\local\temp\b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe"c:\users\admin\appdata\local\temp\b950401f7ed9f9c6c009bab16890214b4b8681bc0ed44b3b60496c60ae6d1670.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3664
-