Analysis
-
max time kernel
132s -
max time network
193s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 02:01
Behavioral task
behavioral1
Sample
c96e991a3e5394204007b3a2a7e5fd26e4db24768abaf5ce1de2ce6c3579499b.exe
Resource
win7-20221111-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c96e991a3e5394204007b3a2a7e5fd26e4db24768abaf5ce1de2ce6c3579499b.exe
Resource
win10v2004-20221111-en
1 signatures
150 seconds
General
-
Target
c96e991a3e5394204007b3a2a7e5fd26e4db24768abaf5ce1de2ce6c3579499b.exe
-
Size
76KB
-
MD5
4cf73fdf7e59e7c72eb37d1b199e1702
-
SHA1
d0156f9892ee807b53211579a3217e9a5448f81f
-
SHA256
c96e991a3e5394204007b3a2a7e5fd26e4db24768abaf5ce1de2ce6c3579499b
-
SHA512
fdd2707b6822e7fb0056c73a8f4e1b61c9ca40bafe7eab1292db469f25ea109b5627a34591ca70422ecc29d2bdabc7ea07297d10ad9c9b0f4e133b310cc6980c
-
SSDEEP
1536:dSBK1LoRhzPrino36MPRfZfHMoL4tmNJCdrYWJT12eOcJKwKl:P1LYhzPriLMPRfZvZ5gpEsJKwKl
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1228-56-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1228-59-0x0000000000400000-0x000000000043B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\SMD = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c96e991a3e5394204007b3a2a7e5fd26e4db24768abaf5ce1de2ce6c3579499b.exe /cs:1 " c96e991a3e5394204007b3a2a7e5fd26e4db24768abaf5ce1de2ce6c3579499b.exe -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\Nod\ c96e991a3e5394204007b3a2a7e5fd26e4db24768abaf5ce1de2ce6c3579499b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c96e991a3e5394204007b3a2a7e5fd26e4db24768abaf5ce1de2ce6c3579499b.exe"C:\Users\Admin\AppData\Local\Temp\c96e991a3e5394204007b3a2a7e5fd26e4db24768abaf5ce1de2ce6c3579499b.exe"1⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
PID:1228