Overview

overview

5

Static

static

3

7x2ly2oujxtagt4f.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    65s
  • max time network
    72s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2023, 19:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    7x2ly2oujxtagt4f.exe

  • Size

    13.8MB

  • MD5

    7ad237a2e5519dc7e265979e9b16788e

  • SHA1

    0a929d02837ab581afb83ee24072ebfc37db9fd5

  • SHA256

    0efbda67c7aa68b97ac95644feaf9cfb1bd56741cb46c2b5ea5646493aa5cdd5

  • SHA512

    5887beb4408ba967ca596132977cf33c2c27a5bbca6d4d47225a0826c8f25bcb497f3b35252ff7f4f9e406d41437b45e1f4cf0691c60ab9e23f0c9b8bef2225f

  • SSDEEP

    196608:kSpiVM7letC51t8YLaXN6XBtG68HF+hRMwQ8ctypA4fksj+VHhroXLdf/bfIa3Cm:ky+MT39a9Mu04wQSpAxHgjfTA

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7x2ly2oujxtagt4f.exe
    "C:\Users\Admin\AppData\Local\Temp\7x2ly2oujxtagt4f.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4924
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 472 -p 5060 -ip 5060
    1⤵
      PID:4140
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 5060 -s 1756
      1⤵
      • Program crash
      PID:224

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4924-133-0x00007FFB2AC10000-0x00007FFB2AC12000-memory.dmp

            Filesize

            8KB

            Download

          • memory/4924-134-0x00007FF78FF40000-0x00007FF7917AA000-memory.dmp

            Filesize

            24.4MB

            Download