b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-05-2023 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe
Size

3.2MB
MD5

e8b0bf65f4b7599b88d870885cf56a97
SHA1

90f64dbfbe1cacaccfddd4e5676d3543b78fac63
SHA256

b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e
SHA512

8b1bc1a817544bef98393ff6d5d6c0486710cea176e763f9d82803a409c0352cfe05f046b37579ca5c45879eef40683a07b65a8fddc76f54471f859b18f0c83c
SSDEEP

49152:7CYeGbfBf2TFASVWBTdE4CfO5qo0zdGtATpO/TcRfhqmTvbKixHKZ7eFxC5PQQXn:OvCcy2v4CJqyqmTu3I4IQ

Score

1^/10

Malware Config

Signatures

Modifies Control Panel 3 IoCs

evasion

Processes:

b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\International\sShortDate = "yyyy-MM-dd"	b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\International\iDate = "2"	b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\International\sDate = "-"	b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe

pid	process
1712	b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe
1712	b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe
1712	b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe

description	pid	process	target process
PID 1712 wrote to memory of 2036	1712	b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe	splwow64.exe
PID 1712 wrote to memory of 2036	1712	b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe	splwow64.exe
PID 1712 wrote to memory of 2036	1712	b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe	splwow64.exe
PID 1712 wrote to memory of 2036	1712	b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe
"C:\Users\Admin\AppData\Local\Temp\b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe"
1⤵
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2036

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Config.ini
Filesize
230B

MD5
6c6c0ab352620fc15e2ad3bbb3c9cfe9

SHA1
94d3f197c9df5d8cf2c3b09bedb122a94adac9d2

SHA256
e577ac3cb2c2022c63fee355691d2910109bc510cf0eaa6b59eb8740bcb6dbb7

SHA512
e67fde1b132c5d0330f023cb364e2e28c9dfa58e76eeea07d24166cc2b8290d32f7729a225dc864e14668544acba7fb97702ca4242904469569d0d1c3395f160

Download Submit
memory/1712-62-0x0000000004120000-0x0000000004121000-memory.dmp

Filesize
4KB

Download
memory/1712-56-0x0000000000400000-0x0000000000D43000-memory.dmp

Filesize
9.3MB

Download
memory/1712-57-0x0000000000400000-0x0000000000D43000-memory.dmp

Filesize
9.3MB

Download
memory/1712-58-0x0000000000400000-0x0000000000D43000-memory.dmp

Filesize
9.3MB

Download
memory/1712-59-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1712-54-0x0000000000400000-0x0000000000D43000-memory.dmp

Filesize
9.3MB

Download
memory/1712-61-0x0000000003F10000-0x0000000003F11000-memory.dmp

Filesize
4KB

Download
memory/1712-63-0x00000000042C0000-0x00000000042C1000-memory.dmp

Filesize
4KB

Download
memory/1712-64-0x00000000043A0000-0x00000000043A1000-memory.dmp

Filesize
4KB

Download
memory/1712-65-0x0000000004620000-0x0000000004621000-memory.dmp

Filesize
4KB

Download
memory/1712-66-0x0000000004900000-0x0000000004901000-memory.dmp

Filesize
4KB

Download
memory/1712-55-0x0000000000400000-0x0000000000D43000-memory.dmp

Filesize
9.3MB

Download
memory/1712-82-0x0000000000400000-0x0000000000D43000-memory.dmp

Filesize
9.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads