Analysis

  • max time kernel
    143s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-07-2023 11:17

General

  • Target

    68735786d42326_JC.exe

  • Size

    407KB

  • MD5

    68735786d4232691b40267794c1a6fe1

  • SHA1

    80f09cf6b48c0ee657c733e16cae7de460046448

  • SHA256

    8ed238d70f1b440c9522734bcd84fbd6ee724ad7cba8db686ec76bbe870c4b43

  • SHA512

    cb9de54a1dc3ad9726e49e5cc6d80c57e50ab53b11aa1badd506aa9067c2af5e3fe0fe5762f63804fe2f0a46079e57bb803345f942ac0754cb82a157cc0f8d16

  • SSDEEP

    12288:DplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:FxRQ+Fucuvm0as

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68735786d42326_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\68735786d42326_JC.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Program Files\approach\development.exe
      "C:\Program Files\approach\development.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\approach\development.exe

    Filesize

    407KB

    MD5

    63a5c1ab04ac7dc871ddd7ee8c326efd

    SHA1

    5bc1adcde3dfec6d1b7071e16a2a2dbcbea1e7f5

    SHA256

    c6b9d9b0a77d311e0857f46ee40dc5be151c1c015893bc5de94f18a913369a1d

    SHA512

    2d79d297c0267a781a081189a1ee6970dc3d649d8aaa86f990a0b82bb29e185dd382031e3fa61396f9d8e584be6f701f97bbd11518684fe5aed27353ef1fff0a

  • C:\Program Files\approach\development.exe

    Filesize

    407KB

    MD5

    63a5c1ab04ac7dc871ddd7ee8c326efd

    SHA1

    5bc1adcde3dfec6d1b7071e16a2a2dbcbea1e7f5

    SHA256

    c6b9d9b0a77d311e0857f46ee40dc5be151c1c015893bc5de94f18a913369a1d

    SHA512

    2d79d297c0267a781a081189a1ee6970dc3d649d8aaa86f990a0b82bb29e185dd382031e3fa61396f9d8e584be6f701f97bbd11518684fe5aed27353ef1fff0a