Overview

overview

6

Static

static

3

92be11f191...52.exe

windows7-x64

6

92be11f191...52.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    140s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2023, 20:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    92be11f1916c577561b76aace5984d8263c0ee300f4b27854f51cbe8a8de4052.exe

  • Size

    5.8MB

  • MD5

    c8fb2b416aa3b2b01b6aa4bf90759dc3

  • SHA1

    fcd991128cbf02245e82191b7e4e9dbc9d1fed23

  • SHA256

    92be11f1916c577561b76aace5984d8263c0ee300f4b27854f51cbe8a8de4052

  • SHA512

    00630c900e453815b2dafc1b498c5fbb707efa1d7a51f93fe34495a97c44f928789a38215ee36fd40495f09c759f9b7315c7a9aa057d5f80c49cfd5b4c3ba9f7

  • SSDEEP

    98304:x6OJGNF7ieLJykMp2WcH5C8EJ0BHyqOpTuJ30tjUozuT:xQNFNJykLNEyFf01RzuT

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Modifies registry class 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 15 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\92be11f1916c577561b76aace5984d8263c0ee300f4b27854f51cbe8a8de4052.exe
    "C:\Users\Admin\AppData\Local\Temp\92be11f1916c577561b76aace5984d8263c0ee300f4b27854f51cbe8a8de4052.exe"
    1⤵
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4152
    • C:\Users\Admin\AppData\Local\Temp\92be11f1916c577561b76aace5984d8263c0ee300f4b27854f51cbe8a8de4052.exe
      "C:\Users\Admin\AppData\Local\Temp\92be11f1916c577561b76aace5984d8263c0ee300f4b27854f51cbe8a8de4052.exe" /tj
      2⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\careueyes\setting_v2.dat
    Filesize

    2KB

    MD5

    85d8b6cfdabc30d6fcb3fe06c14e6657

    SHA1

    ccd532d866efbda73d4e9fd98e988a62ea99eb82

    SHA256

    155800ada8a682db25ed028580429a61dbf1bce0f6bb260a5ad27f4a7c98af2e

    SHA512

    b8ef520e62b7dde7396870cd7f4fa8150ae2e627b3b60d22bf2f15e156e7065bb8bad3d15918b3d39f89ede0909ec6ecfd6f69933eba78891062837b0b092de2

    Download Submit

  • C:\Users\Admin\AppData\Roaming\careueyes\setting_v2.dat
    Filesize

    2KB

    MD5

    5c202062a6ad68d3a575bfbc812dd300

    SHA1

    c09a296f53c6a828fd821bcb13763b28450810df

    SHA256

    51b7091282326e5439c20e32632c3804d81fb515bdfa85b46ce6ff3665daed9a

    SHA512

    9044f7e20a02cceea98ddac54a4e0b002c876947e90c01b8ef66a2f417bf2392c9565149935fa672a4e1f42327544f788bdc21e66a314a77cc9ea2bea50795d0

    Download Submit

  • memory/2040-155-0x0000000003BE0000-0x0000000003BF0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2040-172-0x0000000003BE0000-0x0000000003BF0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4152-133-0x0000000035170000-0x0000000035180000-memory.dmp

    Filesize

    64KB

    Download