Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
24/08/2023, 04:36
Static task
static1
Behavioral task
behavioral1
Sample
9b7dfd2e78df4c90904f960086182e351de8fa2d5181239a07ad8a8804736210.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9b7dfd2e78df4c90904f960086182e351de8fa2d5181239a07ad8a8804736210.exe
Resource
win10v2004-20230703-en
General
-
Target
9b7dfd2e78df4c90904f960086182e351de8fa2d5181239a07ad8a8804736210.exe
-
Size
2.0MB
-
MD5
e21857e894262a0714377a059f49220d
-
SHA1
a9b966efbd5b193bb4d508a5786b67aaedcf9401
-
SHA256
9b7dfd2e78df4c90904f960086182e351de8fa2d5181239a07ad8a8804736210
-
SHA512
c39d1f079769c12b9eede5fd77ca5595fd4c4831daede708b3504e987c92850458fc6c75b4d9a65414ba84bccbdcd286d36c46338651bc2b93c10a07bf4f25e3
-
SSDEEP
24576:NHsvSV6GzanfDW3k7mhiw2TRChRK/CtyLJ47Kj2QK5rccy8lqzwOqi2MhN5ksr:N1XK/C247K3NzzdqVsr
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2504-0-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-1-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-3-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-5-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-7-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-10-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-14-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-12-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-17-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-19-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-21-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-23-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-27-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-25-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-30-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-32-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-35-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-37-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-39-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-42-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-44-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-46-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-48-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/2504-49-0x0000000010000000-0x000000001003D000-memory.dmp upx -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\default_page_url = "http://591314.org/?soft" 9b7dfd2e78df4c90904f960086182e351de8fa2d5181239a07ad8a8804736210.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://591314.org/?soft" 9b7dfd2e78df4c90904f960086182e351de8fa2d5181239a07ad8a8804736210.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2504 9b7dfd2e78df4c90904f960086182e351de8fa2d5181239a07ad8a8804736210.exe 2504 9b7dfd2e78df4c90904f960086182e351de8fa2d5181239a07ad8a8804736210.exe 2504 9b7dfd2e78df4c90904f960086182e351de8fa2d5181239a07ad8a8804736210.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b7dfd2e78df4c90904f960086182e351de8fa2d5181239a07ad8a8804736210.exe"C:\Users\Admin\AppData\Local\Temp\9b7dfd2e78df4c90904f960086182e351de8fa2d5181239a07ad8a8804736210.exe"1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
PID:2504