Analysis
-
max time kernel
138s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2023, 14:55
Behavioral task
behavioral1
Sample
52180940c701a25c80d2451b9508fb76a9c317a4c278f69109739c79b558b4f0.exe
Resource
win7-20230712-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
52180940c701a25c80d2451b9508fb76a9c317a4c278f69109739c79b558b4f0.exe
Resource
win10v2004-20230824-en
2 signatures
150 seconds
General
-
Target
52180940c701a25c80d2451b9508fb76a9c317a4c278f69109739c79b558b4f0.exe
-
Size
3.6MB
-
MD5
cf76da268fbc783087de30dcfa0af608
-
SHA1
301be8fdc4426eacb0ebb098cbe6923a348b391b
-
SHA256
52180940c701a25c80d2451b9508fb76a9c317a4c278f69109739c79b558b4f0
-
SHA512
c1f1234e6f47af1040611802a50542c31ea1f0b82d1450fea498f6855330cb4d771265d40d4f3076c1e9656ba573fee8c660b2baf13811ca6208d88a753bd1ba
-
SSDEEP
98304:NGpt2YL/5kFu3HWoc+u6CirjnXdIyAkLC0nMPsgC:JekwdeyLXdIyzdM
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{26861ED3-3557-4EA7-B3F4-EE52F469188F}.catalogItem svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2028 52180940c701a25c80d2451b9508fb76a9c317a4c278f69109739c79b558b4f0.exe 2028 52180940c701a25c80d2451b9508fb76a9c317a4c278f69109739c79b558b4f0.exe
Processes
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
PID:2748
-
C:\Users\Admin\AppData\Local\Temp\52180940c701a25c80d2451b9508fb76a9c317a4c278f69109739c79b558b4f0.exe"C:\Users\Admin\AppData\Local\Temp\52180940c701a25c80d2451b9508fb76a9c317a4c278f69109739c79b558b4f0.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:2028