Analysis
-
max time kernel
30s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 20:59
Static task
static1
Behavioral task
behavioral1
Sample
e1e807a73e469006adcaead58c19d809b420191a081f731bd4be2b3c1dc05db5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e1e807a73e469006adcaead58c19d809b420191a081f731bd4be2b3c1dc05db5.exe
Resource
win10v2004-20220901-en
General
-
Target
e1e807a73e469006adcaead58c19d809b420191a081f731bd4be2b3c1dc05db5.exe
-
Size
770KB
-
MD5
a7a3deaf060d51409f18b6c244fad249
-
SHA1
645c95a2ee030a1a4948a41794a1bba20437cff8
-
SHA256
e1e807a73e469006adcaead58c19d809b420191a081f731bd4be2b3c1dc05db5
-
SHA512
9ced720137929aff4d34b4aa76a0b3a393c6da368ab63f36471451fe2cb5cb340a1016e2269b816b85946956d20f907bf85b0770a6ed393591abab199b615d3e
-
SSDEEP
12288:r3UXbEuUINtMiLhgQzqZER5uL8UAQ4AZof92QpMCAczRB7rp5+A+1md7odBWU+Id:MNkouof92QpMBczRBXp5+A+m74BWU1d
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1348 e1e807a73e469006adcaead58c19d809b420191a081f731bd4be2b3c1dc05db5.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1348 e1e807a73e469006adcaead58c19d809b420191a081f731bd4be2b3c1dc05db5.exe 1348 e1e807a73e469006adcaead58c19d809b420191a081f731bd4be2b3c1dc05db5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1e807a73e469006adcaead58c19d809b420191a081f731bd4be2b3c1dc05db5.exe"C:\Users\Admin\AppData\Local\Temp\e1e807a73e469006adcaead58c19d809b420191a081f731bd4be2b3c1dc05db5.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1348