2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2023, 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
Size

2.6MB
MD5

c84485f710623d0b73f13e596ac10370
SHA1

e300f53fb44860bfb6210939d650b9e973daf36c
SHA256

2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31
SHA512

4e9be21fbccf58a10f9318c4802e61889be80e537096f2c646dc3e17d42fc76b5c2581bccac62f6f07db570aae75737dcc2869d62e74648b492db5cc4d5f3ee2
SSDEEP

49152:ihzBgRvxchMkwOS1WZLwrZM2Y6eNK9hzj+IR:VtxchlwOUW5AZMk9h/+IR

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 11 IoCs

pid	Process
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ìÓ° ´¦ÀíÍ¼Æ¬\command	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ìÓ° ´¦ÀíÍ¼Æ¬	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ìÓ° ´¦ÀíÍ¼Æ¬\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe %1"	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe

Suspicious use of SetWindowsHookEx 39 IoCs

pid	Process
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
1800	2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe

C:\Users\Admin\AppData\Local\Temp\2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe
"C:\Users\Admin\AppData\Local\Temp\2f5cd141e16cf3f9f804830800ada7433b45116fb9afe78be4376be4e5ea6e31.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E_N4\edroptarget.fne

Filesize
144KB

MD5
c054c9322fe658afca7a31cee39a839a

SHA1
bb299b3fc2a0f0006e10bc6c5fbf22ae687dcfaa

SHA256
23a17adce02920c4fbfb62870073f5f585d332cf437b1e18d363822affef775e

SHA512
2ccf00f3d8bec59032585fe988f5690f9028e5bddeb3b6254b7ed19a873dc2f33edf600e4b86f35f6a5223f11805bd376d2ed6ae561ba9345f29f360e5cc2342

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\edroptarget.fne

Filesize
144KB

MD5
c054c9322fe658afca7a31cee39a839a

SHA1
bb299b3fc2a0f0006e10bc6c5fbf22ae687dcfaa

SHA256
23a17adce02920c4fbfb62870073f5f585d332cf437b1e18d363822affef775e

SHA512
2ccf00f3d8bec59032585fe988f5690f9028e5bddeb3b6254b7ed19a873dc2f33edf600e4b86f35f6a5223f11805bd376d2ed6ae561ba9345f29f360e5cc2342

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\iext.fnr

Filesize
216KB

MD5
cba933625bfa502fc4a1d9f34e1e4473

SHA1
5319194388c0e53321f99f1541b97af191999a09

SHA256
25549c7781b3f1b92e73b0ea721d177207cce914a66f3229a71291f2eb160013

SHA512
f5fb4b97c4f68a20e0847e6528740ce659c4501726f3b2dff1ac83e88a3b7198099da03edb0f069cd4af7ed568a2373597b235cd239895addfa5226d3a444142

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\iext.fnr

Filesize
216KB

MD5
cba933625bfa502fc4a1d9f34e1e4473

SHA1
5319194388c0e53321f99f1541b97af191999a09

SHA256
25549c7781b3f1b92e73b0ea721d177207cce914a66f3229a71291f2eb160013

SHA512
f5fb4b97c4f68a20e0847e6528740ce659c4501726f3b2dff1ac83e88a3b7198099da03edb0f069cd4af7ed568a2373597b235cd239895addfa5226d3a444142

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\iext2.fne

Filesize
460KB

MD5
6eb20bb6cafd6d31e871ed3abd65a59c

SHA1
ae6495ea4241bcde20e415f2940313785a4a10d2

SHA256
2b3fe250f07229eaa58d1bc0c4ac103ba69ad622c27410151ce1d6d46a174bae

SHA512
562edc1f058bc280333a6659fceb5a51b3a40bea7aca87db09b0cc1ca1966f26f2a7e4760b944e2502e20257544f85cf9c32f583f1dec06271a35dcfb8fa90f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\iext2.fne

Filesize
460KB

MD5
6eb20bb6cafd6d31e871ed3abd65a59c

SHA1
ae6495ea4241bcde20e415f2940313785a4a10d2

SHA256
2b3fe250f07229eaa58d1bc0c4ac103ba69ad622c27410151ce1d6d46a174bae

SHA512
562edc1f058bc280333a6659fceb5a51b3a40bea7aca87db09b0cc1ca1966f26f2a7e4760b944e2502e20257544f85cf9c32f583f1dec06271a35dcfb8fa90f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\iext3.fne

Filesize
380KB

MD5
07f0db2727c8288cd2cf7c4cf352708d

SHA1
caf2d1b631c785c1f6f01189cf841fc2661666ed

SHA256
3c18183857979a2b5664d3f852f74e3f31f0626720654914453e964938e18f5e

SHA512
b81029a2968663a180feca2e3e47f4736f87a7cc73e6a9153aa227b91d963e077f44c5a289b9f64d6b481b7bd5ccb4bcb762048a4f29810c1f4fd4e6106cb0d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\iext3.fne

Filesize
380KB

MD5
07f0db2727c8288cd2cf7c4cf352708d

SHA1
caf2d1b631c785c1f6f01189cf841fc2661666ed

SHA256
3c18183857979a2b5664d3f852f74e3f31f0626720654914453e964938e18f5e

SHA512
b81029a2968663a180feca2e3e47f4736f87a7cc73e6a9153aa227b91d963e077f44c5a289b9f64d6b481b7bd5ccb4bcb762048a4f29810c1f4fd4e6106cb0d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\iext6.fne

Filesize
220KB

MD5
5dcf6693c3dfd4fcfdf49dc91e108201

SHA1
c6c3f62e41ae9f8d3a090b0f2b86e61ffcfacd1e

SHA256
ffd03f2eb467fe39a797ae78efab31b1aaacdd43509b48046af811453131880c

SHA512
49f5fb11c7495962c22e71cbddc571982c4147e289f0481ab0dc0142056f16e5175391495e7a4feefb24a4aef5d7e9c7ea9c3054be3199e39f42521da2899e20

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\iext6.fne

Filesize
220KB

MD5
5dcf6693c3dfd4fcfdf49dc91e108201

SHA1
c6c3f62e41ae9f8d3a090b0f2b86e61ffcfacd1e

SHA256
ffd03f2eb467fe39a797ae78efab31b1aaacdd43509b48046af811453131880c

SHA512
49f5fb11c7495962c22e71cbddc571982c4147e289f0481ab0dc0142056f16e5175391495e7a4feefb24a4aef5d7e9c7ea9c3054be3199e39f42521da2899e20

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

Filesize
1.1MB

MD5
638e737b2293cf7b1f14c0b4fb1f3289

SHA1
f8e2223348433b992a8c42c4a7a9fb4b5c1158bc

SHA256
baad4798c3ab24dec8f0ac3cde48e2fee2e2dffa60d2b2497cd295cd6319fd5b

SHA512
4d714a0980238c49af10376ff26ec9e6415e7057925b32ec1c24780c3671047ac5b5670e46c1c6cf9f160519be8f37e1e57f05c30c6c4bda3b275b143aa0bf12

Download Submit
memory/1800-30-0x0000000002E80000-0x0000000002EC4000-memory.dmp

Filesize
272KB

Download
memory/1800-23-0x0000000002B50000-0x0000000002B77000-memory.dmp

Filesize
156KB

Download
memory/1800-0-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/1800-37-0x00000000044C0000-0x0000000004506000-memory.dmp

Filesize
280KB

Download
memory/1800-16-0x0000000002930000-0x000000000299F000-memory.dmp

Filesize
444KB

Download
memory/1800-44-0x0000000004680000-0x0000000004703000-memory.dmp

Filesize
524KB

Download
memory/1800-48-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads