Analysis
- max time kernel
142s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
18/08/2023, 20:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe
Resource
win7-20230712-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe
- Size 136KB
- Sample230818-yzfqcsfa7z
- SHA256 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9
- MD5 a1a85fcef73266c19ec914c7058035bf
- SHA1 8ebfddd1d6c433a5db22826377d24a0913186e76
- SHA512 b6644d44e6546fa59f037e71e665a1849e43993972c2e74c00a072f6a19f686fc6025c9dc6783c0ee46caafbc447a8c2e2d299edc87865b7081d2fda53632482
- SSDEEP 1536:P5yF90XjAS33swN77tkxP8ZSa6THmQYT2oa60UuiEI3ao+8JzZ:gOswVuhTHDYTla60UuiEI3ao+8JzZ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1500 06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe 3092 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe"C:\Users\Admin\AppData\Local\Temp\06769e249b2a7d9118638c9946199fbd19f534eae1a49eee76457a2c303510c9.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1500
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3092