Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 13:00
Static task
static1
Behavioral task
behavioral1
Sample
e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe
Resource
win10v2004-20220812-en
General
-
Target
e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe
-
Size
374KB
-
MD5
cf098543fa5f706437de1fae85db2425
-
SHA1
579d7ac04e05b7233efafea5c074b9f1bfc93998
-
SHA256
e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227
-
SHA512
f3fc042c2ea1151b5da1bfe27ddab87f31644a4d4770bd794c2aae231b4192288d3ce0a4e194e6b0774745d66ee5521ba7b1a204f18ef2c3236bd4858f234b8d
-
SSDEEP
6144:lgdPL5/M6Wbi4cgZ/e9+YWT/0G6PAc9op8cxO6OpCLhScRAkTlbXiqqv1z7b:GdPLrWbi4o9MEPAc9hcxOpYdZTZXLqvl
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\QuickWM\e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe File opened for modification C:\Program Files (x86)\QuickWM\e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\hosts e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe File created C:\Windows\Help\Tours\htmlTour\mui\0419\misc\bonus.wmi e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe File opened for modification C:\Windows\Help\Tours\htmlTour\mui\0419\misc\bonus.wmi e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 388 e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe 388 e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe 388 e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe"C:\Users\Admin\AppData\Local\Temp\e24dccc4322218e7dffd5b91e6f08306ca3a8a145bb597f1cc06e943002cb227.exe"1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:388