Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 06:38
Behavioral task
behavioral1
Sample
f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe
Resource
win7-20230712-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe
Resource
win10v2004-20230703-en
4 signatures
150 seconds
General
-
Target
f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe
-
Size
1.4MB
-
MD5
bb018a0baac3a9cf9ac2b3ca5b3fa3f6
-
SHA1
217116a64698a15b2e02841a3ea48667f12366b4
-
SHA256
f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1
-
SHA512
59d86081b384cac4df82602c5d1e125648e918e54bf12f73c99182e59a9c0b9ce22904242d489fab2336353f645ef5f3339aed60c93deb82692f86096f3c9e9f
-
SSDEEP
24576:fuQqwO6PsvduOX/BwnBKyvxUtDxIZt/0FkUu0UopJTO5/9V:f7qwHsvdBmB9ZCDEYkUu0jM/9V
Score
1/10
Malware Config
Signatures
-
Modifies Control Panel 13 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\iDate = "2" f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\sTimeFormat = "HH:mm:ss" f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\iTime = "1" f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\iTimePrefix = "0" f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\s2359 f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\iDigits = "2" f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\iCurrDigits = "2" f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\sShortDate = "yyyy-MM-dd" f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\sTime = ":" f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\s1159 f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\sDate = "-" f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\sLongDate = "yyyy-MM-dd" f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\iTLZero = "1" f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1368 f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSystemtimePrivilege 1368 f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe Token: SeSystemtimePrivilege 1368 f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1368 f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe"C:\Users\Admin\AppData\Local\Temp\f0d8aa0a762a0106a6afce5dc8f1e2e0c5b1715c815265ba8ba62650110aade1.exe"1⤵
- Modifies Control Panel
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1368