5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6

Analysis

max time kernel
373s
max time network
463s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Size

665KB
MD5

cb099797970fbb603bdec881c8d42d6f
SHA1

dadeae5cc1ea4f7414f068ff01daaa9a370a1f25
SHA256

5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6
SHA512

374a2f579c40b7ba63cf765f78be7d2090bd5ef93f0fde4a6eb8d62d9080afb42da8379fec4d0763d082ea0cec29a46bf9de67139418acddc28ec0bfab4a43af
SSDEEP

12288:OS3NhIPYYE49Se82bBv7qYaX+jx0tete2uVVlxyKjYYL3SNokDzPM5lK:h9LYuehbBzqYM+jx0gVgVlhYA4vbMnK

Score

1^/10

Malware Config

Signatures

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID\ = "5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.MyNSHandler"	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ = "this is my ebook"	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe"	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.MyNSHandler	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.MyNSHandler\Clsid	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.MyNSHandler\Clsid\ = "{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}"	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.MyNSHandler\ = "this is my ebook"	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4528	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
4528	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe

C:\Users\Admin\AppData\Local\Temp\5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
"C:\Users\Admin\AppData\Local\Temp\5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4528

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads