32ddcc6f742fbea0ac065aa2a727933d8ebdebdf7c3ac869adaa6e946e20be89

Analysis

max time kernel
146s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-01-2023 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

httpfileserver.exe
Size

2.1MB
MD5

9e8557e98ed1269372ff0ace91d63477
SHA1

d0c4192b65e36553f6fd2b83f3123f6ae8380dac
SHA256

e678899d7ea9702184167b56655f91a69f8a0bdc9df65612762252c053c2cd7c
SHA512

c1a338c0414ac68d7ce24df06f3b665a56feae15063332324fea3250f1e77c19209ea3d89fe3a06d48974cce70bd9c65d59b7e2fbaf27c3f01ac2e898057e9ec
SSDEEP

49152:UR0LvNmmh9otEKMx9XSNVBOw+V4UvEbAThhiqvyo98ZcW7SZ:UR0xmmh9GEKgpSNVBr72QN

Score

1^/10

Malware Config

Signatures

Modifies registry class 16 IoCs

Processes:

httpfileserver.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\Add to HFS\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\httpfileserver.exe\" \"%1\""	httpfileserver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\Add to HFS\command	httpfileserver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vfs	httpfileserver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vfs\shell	httpfileserver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vfs\shell\Open	httpfileserver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder	httpfileserver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vfs\ = "HFS file system"	httpfileserver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vfs\shell\Open\command	httpfileserver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\Add to HFS\command	httpfileserver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*	httpfileserver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell	httpfileserver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\Add to HFS	httpfileserver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell	httpfileserver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vfs\shell\Open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\httpfileserver.exe\" \"%1\""	httpfileserver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\Add to HFS	httpfileserver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\Add to HFS\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\httpfileserver.exe\" \"%1\""	httpfileserver.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

httpfileserver.exe

pid	process
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe

Suspicious use of SendNotifyMessage 25 IoCs

Processes:

httpfileserver.exe

pid	process
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe
1780	httpfileserver.exe

C:\Users\Admin\AppData\Local\Temp\httpfileserver.exe
"C:\Users\Admin\AppData\Local\Temp\httpfileserver.exe"
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1780

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1780-54-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads