Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 05:50
Behavioral task
behavioral1
Sample
f54e9f45d7f454471defcd3841e791951934e32e58b2e6e5bb501a5989c319b7.exe
Resource
win7-20220901-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
f54e9f45d7f454471defcd3841e791951934e32e58b2e6e5bb501a5989c319b7.exe
Resource
win10v2004-20220901-en
4 signatures
150 seconds
General
-
Target
f54e9f45d7f454471defcd3841e791951934e32e58b2e6e5bb501a5989c319b7.exe
-
Size
32KB
-
MD5
e949227ec0bd31068ca7f34047301402
-
SHA1
e9eead2c88a87bd72a246a03c0f9920e5df3b9b8
-
SHA256
f54e9f45d7f454471defcd3841e791951934e32e58b2e6e5bb501a5989c319b7
-
SHA512
cd9b83206226eed9954c4599d15e0fc5eea3c9e006bbe3285c2f5c005a6426ce1244682f5d28a7a84b4a48e0a81e1f764f6a7abfd57f81b1e7ae90d644ad3d75
-
SSDEEP
768:0693UZtPokufvIfejL3sKRjK8tyFf5aV2er/1vE:06VuAkufi4AyB4BaVU
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4964-137-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4964-138-0x0000000000400000-0x000000000042C000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\tj.txt f54e9f45d7f454471defcd3841e791951934e32e58b2e6e5bb501a5989c319b7.exe File created C:\Windows\bj.txt f54e9f45d7f454471defcd3841e791951934e32e58b2e6e5bb501a5989c319b7.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4964 f54e9f45d7f454471defcd3841e791951934e32e58b2e6e5bb501a5989c319b7.exe 4964 f54e9f45d7f454471defcd3841e791951934e32e58b2e6e5bb501a5989c319b7.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4964 f54e9f45d7f454471defcd3841e791951934e32e58b2e6e5bb501a5989c319b7.exe 4964 f54e9f45d7f454471defcd3841e791951934e32e58b2e6e5bb501a5989c319b7.exe 4964 f54e9f45d7f454471defcd3841e791951934e32e58b2e6e5bb501a5989c319b7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f54e9f45d7f454471defcd3841e791951934e32e58b2e6e5bb501a5989c319b7.exe"C:\Users\Admin\AppData\Local\Temp\f54e9f45d7f454471defcd3841e791951934e32e58b2e6e5bb501a5989c319b7.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4964