Analysis
-
max time kernel
89s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 01:34
Static task
static1
Behavioral task
behavioral1
Sample
c172380ac82c1d7f434881dcfd08210e747194b80772130ced88c1be9ff4d4c8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c172380ac82c1d7f434881dcfd08210e747194b80772130ced88c1be9ff4d4c8.exe
Resource
win10v2004-20220901-en
General
-
Target
c172380ac82c1d7f434881dcfd08210e747194b80772130ced88c1be9ff4d4c8.exe
-
Size
49KB
-
MD5
9f20fe2cccb9f5f18bfa8034f6524bbc
-
SHA1
631bdf9f2d1374f7ce237b654b9b97995101c087
-
SHA256
c172380ac82c1d7f434881dcfd08210e747194b80772130ced88c1be9ff4d4c8
-
SHA512
69a052a71e77ff8f6a2c51cc41e198b8f8e03fadb165be9a277620cb6dcdd011585dfcd3af3f77182ac6edd8aac75610aa96bb34aa2b7121ea8a198529d91b1d
-
SSDEEP
768:80DI8ZHpVVN5GhRZjvCDymM8JXbVpkQgyRgj4MJSevNMhaO6FdU6hVt9C:80Dr1yRZBmnXbVcpMxeVMhaO6rnt9C
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 3400 c172380ac82c1d7f434881dcfd08210e747194b80772130ced88c1be9ff4d4c8.exe 3400 c172380ac82c1d7f434881dcfd08210e747194b80772130ced88c1be9ff4d4c8.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.2dt c172380ac82c1d7f434881dcfd08210e747194b80772130ced88c1be9ff4d4c8.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\system.2dt c172380ac82c1d7f434881dcfd08210e747194b80772130ced88c1be9ff4d4c8.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.dll c172380ac82c1d7f434881dcfd08210e747194b80772130ced88c1be9ff4d4c8.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3400 c172380ac82c1d7f434881dcfd08210e747194b80772130ced88c1be9ff4d4c8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c172380ac82c1d7f434881dcfd08210e747194b80772130ced88c1be9ff4d4c8.exe"C:\Users\Admin\AppData\Local\Temp\c172380ac82c1d7f434881dcfd08210e747194b80772130ced88c1be9ff4d4c8.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3400
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD546d86f57db63b6311850387f250c3f5f
SHA1d62c072ec57b1d71e350f35854b06378f8666810
SHA2561ebc43499dcf43758ad4b790c937cbe6fb601efa294cf2db7362d3a30c15a8db
SHA512adeeef488867468a5b99ce24192744265627b2b9fe4834f8b5ef8130a952c2026694806a270094b7fb743bf99b08a7b17209ac36c8b532883370b20f7dcafa8f
-
Filesize
27KB
MD546d86f57db63b6311850387f250c3f5f
SHA1d62c072ec57b1d71e350f35854b06378f8666810
SHA2561ebc43499dcf43758ad4b790c937cbe6fb601efa294cf2db7362d3a30c15a8db
SHA512adeeef488867468a5b99ce24192744265627b2b9fe4834f8b5ef8130a952c2026694806a270094b7fb743bf99b08a7b17209ac36c8b532883370b20f7dcafa8f