171894e63acff63cfb999967ff1511724934610e00f0e3f64835b68ae3207b6f

Analysis

max time kernel
121s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2023 13:22

Target

171894e63acff63cfb999967ff1511724934610e00f0e3f64835b68ae3207b6f.exe
Size

3.7MB
MD5

5364f31703782a967c6b07750947f760
SHA1

2d6cd8a669f573d8115051c202d1cc6e1740cade
SHA256

171894e63acff63cfb999967ff1511724934610e00f0e3f64835b68ae3207b6f
SHA512

48573d781f0adad740fececc82b4a8eccab0a8ee33052e7729d84eaf54d0c38fa0389267b6b8dc599307f1832e6ca83cf136664c3481510dc7ce25749c9b0292
SSDEEP

98304:llGCyQENE1mu660KDCrfbwCpZEQ3ph6UHIcJ/xc0C:TGCyQEWntCrfsWp0HcJp3C

Score

1^/10

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XlegendGdo\shell\open\command	171894e63acff63cfb999967ff1511724934610e00f0e3f64835b68ae3207b6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XlegendGdo\URL Protocol	171894e63acff63cfb999967ff1511724934610e00f0e3f64835b68ae3207b6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XlegendGdo\DefaultIcon	171894e63acff63cfb999967ff1511724934610e00f0e3f64835b68ae3207b6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XlegendGdo\shell	171894e63acff63cfb999967ff1511724934610e00f0e3f64835b68ae3207b6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XlegendGdo\shell\open	171894e63acff63cfb999967ff1511724934610e00f0e3f64835b68ae3207b6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XlegendGdo\ = "URL:Xlegend Protocol"	171894e63acff63cfb999967ff1511724934610e00f0e3f64835b68ae3207b6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XlegendGdo\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Launcher.exe,1"	171894e63acff63cfb999967ff1511724934610e00f0e3f64835b68ae3207b6f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XlegendGdo\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Launcher.exe %1"	171894e63acff63cfb999967ff1511724934610e00f0e3f64835b68ae3207b6f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XlegendGdo	171894e63acff63cfb999967ff1511724934610e00f0e3f64835b68ae3207b6f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3556	171894e63acff63cfb999967ff1511724934610e00f0e3f64835b68ae3207b6f.exe