Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16-08-2023 10:17
Static task
static1
Behavioral task
behavioral1
Sample
12ac80118255805874d0236a8d8ccc9baf62da104e0cd689811ca3ebf3ee162b.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
12ac80118255805874d0236a8d8ccc9baf62da104e0cd689811ca3ebf3ee162b.exe
Resource
win10v2004-20230703-en
General
-
Target
12ac80118255805874d0236a8d8ccc9baf62da104e0cd689811ca3ebf3ee162b.exe
-
Size
2.9MB
-
MD5
862dfba38258601a001f0473aa14f687
-
SHA1
f7b1f946fb7f25491a035bad2d042ae39e820f99
-
SHA256
12ac80118255805874d0236a8d8ccc9baf62da104e0cd689811ca3ebf3ee162b
-
SHA512
2c7a9b2d1d9c19fdffd15dd020f90b094e28c788bf68ecf5dc63e83b7e32dc62477b524f96de2a3648cb3c8cbab65e6ebe2c5263e735559348ec7753fc7a880c
-
SSDEEP
49152:N5YQm5dPDv06JzNeTEzQ4lqsabcs2dhKSs0lAfk2W92TzNOV7S3lcCVlKcTdMQtB:XYQm5drv0pRoH/H80lAfk2o2TzNOF+lv
Malware Config
Signatures
-
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E3AF66D-9A24-48db-8670-B13CB4E79FBB} 12ac80118255805874d0236a8d8ccc9baf62da104e0cd689811ca3ebf3ee162b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E3AF66D-9A24-48db-8670-B13CB4E79FBB}\MiscStatus 12ac80118255805874d0236a8d8ccc9baf62da104e0cd689811ca3ebf3ee162b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E3AF66D-9A24-48db-8670-B13CB4E79FBB}\MiscStatus\1\TRCU = "1694859464" 12ac80118255805874d0236a8d8ccc9baf62da104e0cd689811ca3ebf3ee162b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E3AF66D-9A24-48db-8670-B13CB4E79FBB}\MiscStatus\1\LUCU = "1692181064" 12ac80118255805874d0236a8d8ccc9baf62da104e0cd689811ca3ebf3ee162b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E3AF66D-9A24-48db-8670-B13CB4E79FBB}\MiscStatus\1 12ac80118255805874d0236a8d8ccc9baf62da104e0cd689811ca3ebf3ee162b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 12ac80118255805874d0236a8d8ccc9baf62da104e0cd689811ca3ebf3ee162b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 12ac80118255805874d0236a8d8ccc9baf62da104e0cd689811ca3ebf3ee162b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 748 12ac80118255805874d0236a8d8ccc9baf62da104e0cd689811ca3ebf3ee162b.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
746B
MD5d1c48319d067ef4350d78ad7eedb4f21
SHA1977faad98291c5f398d26f22803be3b4ee86e6e7
SHA256b8c1fb0f3af5a6400a8408b3f03b9f317a841163525d035e697bdac5db94ff21
SHA512afd0898da822c918341c8035166ec96db1d17808bd76ede3c7bfb555ae2c80712cfe04cc89b262e312535ab9b3ed8cd2ffb76802df31dc435e9e577bab59a4f7