Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
29-05-2023 11:02
Behavioral task
behavioral1
Sample
52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe
Resource
win10v2004-20230220-en
General
-
Target
52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe
-
Size
3.2MB
-
MD5
97184243a24e376fbf7aa5a4e1091b9c
-
SHA1
f957f7799166c2e42e0e6f252162d8d138d3ba5e
-
SHA256
52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d
-
SHA512
45c3a3458e5be1fd4d92bfefc516570cfea09310dffca5010e3876f2e06f2b9a69ba8054649a8afd21bb909829dcd90f4e6a3be787a95f46efcb7ced719dc6e3
-
SSDEEP
49152:dCYeGbfBf2DMDaLu20+xyKrtfH8521coA8Ug8+9jWhqmTvbKixHKZ7eFxC5Sy/3y:YvCRmB0Kco3dDjkqmTu3I4SmVQ
Malware Config
Signatures
-
Modifies Control Panel 3 IoCs
Processes:
52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\International\sShortDate = "yyyy-MM-dd" 52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\International\iDate = "2" 52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\International\sDate = "-" 52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exepid process 1212 52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe 1212 52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe 1212 52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exedescription pid process target process PID 1212 wrote to memory of 976 1212 52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe splwow64.exe PID 1212 wrote to memory of 976 1212 52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe splwow64.exe PID 1212 wrote to memory of 976 1212 52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe splwow64.exe PID 1212 wrote to memory of 976 1212 52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe"C:\Users\Admin\AppData\Local\Temp\52082779b32c26d29236ea980e70fb3cf2578d9883ea784ae6a3f83b1b82862d.exe"1⤵
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:976
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Config.iniFilesize
230B
MD56c6c0ab352620fc15e2ad3bbb3c9cfe9
SHA194d3f197c9df5d8cf2c3b09bedb122a94adac9d2
SHA256e577ac3cb2c2022c63fee355691d2910109bc510cf0eaa6b59eb8740bcb6dbb7
SHA512e67fde1b132c5d0330f023cb364e2e28c9dfa58e76eeea07d24166cc2b8290d32f7729a225dc864e14668544acba7fb97702ca4242904469569d0d1c3395f160
-
memory/1212-61-0x0000000003F10000-0x0000000003F11000-memory.dmpFilesize
4KB
-
memory/1212-56-0x0000000000400000-0x0000000000D43000-memory.dmpFilesize
9.3MB
-
memory/1212-57-0x0000000000400000-0x0000000000D43000-memory.dmpFilesize
9.3MB
-
memory/1212-58-0x0000000000400000-0x0000000000D43000-memory.dmpFilesize
9.3MB
-
memory/1212-59-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1212-54-0x0000000000400000-0x0000000000D43000-memory.dmpFilesize
9.3MB
-
memory/1212-62-0x0000000004120000-0x0000000004121000-memory.dmpFilesize
4KB
-
memory/1212-63-0x00000000042C0000-0x00000000042C1000-memory.dmpFilesize
4KB
-
memory/1212-65-0x0000000004620000-0x0000000004621000-memory.dmpFilesize
4KB
-
memory/1212-64-0x00000000043A0000-0x00000000043A1000-memory.dmpFilesize
4KB
-
memory/1212-66-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/1212-55-0x0000000000400000-0x0000000000D43000-memory.dmpFilesize
9.3MB
-
memory/1212-82-0x0000000000400000-0x0000000000D43000-memory.dmpFilesize
9.3MB