Analysis
-
max time kernel
134s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 06:20
Static task
static1
Behavioral task
behavioral1
Sample
9aaf7535d5d9d5a85fe7923a0f0b3ef3cb00451911ea00518498c11bcb59c628.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9aaf7535d5d9d5a85fe7923a0f0b3ef3cb00451911ea00518498c11bcb59c628.exe
Resource
win10v2004-20220901-en
General
-
Target
9aaf7535d5d9d5a85fe7923a0f0b3ef3cb00451911ea00518498c11bcb59c628.exe
-
Size
775KB
-
MD5
31a454d4ed76d598141c77aca3f405b3
-
SHA1
b3ac8801f6271db922a7a045099d9771b1f34ea8
-
SHA256
9aaf7535d5d9d5a85fe7923a0f0b3ef3cb00451911ea00518498c11bcb59c628
-
SHA512
466348ef2b08445df7dc0910c6b9e1e5d9e98586c2a0c1360cae0c062e5b835f42671d6168f40f0fe534e9b3866272cf50f9ae38f391d7361a1d2ff7bd156864
-
SSDEEP
12288:VVef8lF4MXhz6BIU/FJjSS25THIHeU5CIIAOJPJfJV29n9Z5WmAIpT31S1P:2ErYCpXHIHL5pOdJhV2t5WmAsT
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\mslabele.h 9aaf7535d5d9d5a85fe7923a0f0b3ef3cb00451911ea00518498c11bcb59c628.exe File opened for modification C:\Windows\SysWOW64\mslabele.h 9aaf7535d5d9d5a85fe7923a0f0b3ef3cb00451911ea00518498c11bcb59c628.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ogenI.log 9aaf7535d5d9d5a85fe7923a0f0b3ef3cb00451911ea00518498c11bcb59c628.exe File opened for modification C:\Windows\ogenI.log 9aaf7535d5d9d5a85fe7923a0f0b3ef3cb00451911ea00518498c11bcb59c628.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2912 9aaf7535d5d9d5a85fe7923a0f0b3ef3cb00451911ea00518498c11bcb59c628.exe 2912 9aaf7535d5d9d5a85fe7923a0f0b3ef3cb00451911ea00518498c11bcb59c628.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9aaf7535d5d9d5a85fe7923a0f0b3ef3cb00451911ea00518498c11bcb59c628.exe"C:\Users\Admin\AppData\Local\Temp\9aaf7535d5d9d5a85fe7923a0f0b3ef3cb00451911ea00518498c11bcb59c628.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2912