a09b78095c90b4d9da34f22bf2ef7daac3576a0b00094c4ceed703c494dfe5f1

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22-08-2023 23:22

Target

a09b78095c90b4d9da34f22bf2ef7daac3576a0b00094c4ceed703c494dfe5f1.exe
Size

428KB
MD5

6b703663069f79945149041c95b77cbe
SHA1

25218d7fae8b75f3fe028d6e35b3b33df6bf168d
SHA256

a09b78095c90b4d9da34f22bf2ef7daac3576a0b00094c4ceed703c494dfe5f1
SHA512

8b15b51dbdc12bed3e875ad42594319d64511e4f584b7089f344dac9e2ea7160a356cea8cf672c0770d27bd483f49ca28e5304c207c7157fa3ac1f6149e0efaf
SSDEEP

12288:IZcMB3qjTLF1vZGT9ge/ehbTgFh/6yRhfX11zRpdoS:IZXBajTxy5ehHGrxXvz

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1940-54-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/memory/1940-157-0x0000000000400000-0x00000000004CF000-memory.dmp	upx

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\?????MirServer??\command	a09b78095c90b4d9da34f22bf2ef7daac3576a0b00094c4ceed703c494dfe5f1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*	a09b78095c90b4d9da34f22bf2ef7daac3576a0b00094c4ceed703c494dfe5f1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell	a09b78095c90b4d9da34f22bf2ef7daac3576a0b00094c4ceed703c494dfe5f1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\?????MirServer??	a09b78095c90b4d9da34f22bf2ef7daac3576a0b00094c4ceed703c494dfe5f1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\?????MirServer??\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a09b78095c90b4d9da34f22bf2ef7daac3576a0b00094c4ceed703c494dfe5f1.exe \"%1\""	a09b78095c90b4d9da34f22bf2ef7daac3576a0b00094c4ceed703c494dfe5f1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\?????MirServer??\icon = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a09b78095c90b4d9da34f22bf2ef7daac3576a0b00094c4ceed703c494dfe5f1.exe"	a09b78095c90b4d9da34f22bf2ef7daac3576a0b00094c4ceed703c494dfe5f1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1940	a09b78095c90b4d9da34f22bf2ef7daac3576a0b00094c4ceed703c494dfe5f1.exe

C:\Users\Admin\AppData\Local\Temp\a09b78095c90b4d9da34f22bf2ef7daac3576a0b00094c4ceed703c494dfe5f1.ini

Filesize
1KB

MD5
0f638d03675ee81f1a768bc0e9768635

SHA1
a6053c66695fc6c487a8e758865bbe31a09a1d02

SHA256
cb2e4c110450e547aa889e75bbb8abfa53bee40cbc33bc8f7e33b251528e0365

SHA512
366d34d9c51630c66385bed401f40447ba78cd5e574efe95c41d4064551ac22fdfb20486527d2061b9437d64d9ae9bf394f2068aba0b659ae465b3d8328fdd5d

Download Submit
memory/1940-54-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1940-157-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download