f0d43f28edc5c0d0627115ebd4b4a679ec6a5c57f6b6be1fee4f27dfa283df60

Analysis

max time kernel
141s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2023 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0d43f28edc5c0d0627115ebd4b4a679ec6a5c57f6b6be1fee4f27dfa283df60.exe
Size

8.6MB
MD5

5833e9e75892c8487a6469f8eda1323e
SHA1

b5526f95ca148685eec7cac1a4cd2bf82d1250e6
SHA256

f0d43f28edc5c0d0627115ebd4b4a679ec6a5c57f6b6be1fee4f27dfa283df60
SHA512

a0ecaca5e161b52843240453d6da6050b3f91e071cf950b211114d14019d0dfa2a3d0d89a1d2ec35027bdc2f2663d706c4feccfdda2ec893adaff74fe9443394
SSDEEP

196608:sDl2wka2bilu/g0GhDfWcWvYzdDdGaO4ytK6prdMkPe2tosdE48K4nao:9wkU0g0iDfWWpC4bahMIoNTpn3

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	f0d43f28edc5c0d0627115ebd4b4a679ec6a5c57f6b6be1fee4f27dfa283df60.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\HappinessClock\bin\HappinessClockdb32.dll	f0d43f28edc5c0d0627115ebd4b4a679ec6a5c57f6b6be1fee4f27dfa283df60.exe
File opened for modification	C:\Program Files (x86)\HappinessClock\bin\HappinessClockdb32.dll	f0d43f28edc5c0d0627115ebd4b4a679ec6a5c57f6b6be1fee4f27dfa283df60.exe
File created	C:\Program Files (x86)\HappinessClock\bin\HappinessClockdb64.dll	f0d43f28edc5c0d0627115ebd4b4a679ec6a5c57f6b6be1fee4f27dfa283df60.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
860	3440	WerFault.exe	84

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3440	f0d43f28edc5c0d0627115ebd4b4a679ec6a5c57f6b6be1fee4f27dfa283df60.exe
3440	f0d43f28edc5c0d0627115ebd4b4a679ec6a5c57f6b6be1fee4f27dfa283df60.exe
3440	f0d43f28edc5c0d0627115ebd4b4a679ec6a5c57f6b6be1fee4f27dfa283df60.exe

C:\Users\Admin\AppData\Local\Temp\f0d43f28edc5c0d0627115ebd4b4a679ec6a5c57f6b6be1fee4f27dfa283df60.exe
"C:\Users\Admin\AppData\Local\Temp\f0d43f28edc5c0d0627115ebd4b4a679ec6a5c57f6b6be1fee4f27dfa283df60.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 984
  2⤵
  - Program crash
  PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3440 -ip 3440
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads