Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2023, 18:54
Static task
static1
Behavioral task
behavioral1
Sample
10f03b93bbbabe6634e32cbf1708b09a7da9aedc3ff0f13624fb8d0e16d92d7e.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
10f03b93bbbabe6634e32cbf1708b09a7da9aedc3ff0f13624fb8d0e16d92d7e.exe
Resource
win10v2004-20230915-en
General
-
Target
10f03b93bbbabe6634e32cbf1708b09a7da9aedc3ff0f13624fb8d0e16d92d7e.exe
-
Size
4.5MB
-
MD5
9b23aef038dba9da94132bce5f8b87b4
-
SHA1
58476c9ec1c08afacea0fcf64af336e2845f9486
-
SHA256
10f03b93bbbabe6634e32cbf1708b09a7da9aedc3ff0f13624fb8d0e16d92d7e
-
SHA512
c5a5822dd4d7bef710c2f2f85bb8af4b5e26372291a8359bcc91066135f5d7019b6cef02bcd64ecfa2224ffc380dfbafb7e9cbc26f30b36c741c5ad54b5d231f
-
SSDEEP
98304:TnNQjlG4cEScWPgtX2aDMyQwrBOOWkFAhdwsHETCCZ:6cEGo2arQw7WogwY0Ce
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\System32\drivers\etc\hosts 10f03b93bbbabe6634e32cbf1708b09a7da9aedc3ff0f13624fb8d0e16d92d7e.exe File opened for modification C:\Windows\System32\drivers\etc\hosts 10f03b93bbbabe6634e32cbf1708b09a7da9aedc3ff0f13624fb8d0e16d92d7e.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4924 10f03b93bbbabe6634e32cbf1708b09a7da9aedc3ff0f13624fb8d0e16d92d7e.exe 4924 10f03b93bbbabe6634e32cbf1708b09a7da9aedc3ff0f13624fb8d0e16d92d7e.exe 4924 10f03b93bbbabe6634e32cbf1708b09a7da9aedc3ff0f13624fb8d0e16d92d7e.exe 4924 10f03b93bbbabe6634e32cbf1708b09a7da9aedc3ff0f13624fb8d0e16d92d7e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10f03b93bbbabe6634e32cbf1708b09a7da9aedc3ff0f13624fb8d0e16d92d7e.exe"C:\Users\Admin\AppData\Local\Temp\10f03b93bbbabe6634e32cbf1708b09a7da9aedc3ff0f13624fb8d0e16d92d7e.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
PID:4924
-
C:\Windows\system32\pacjsworker.exeC:\Windows\system32\pacjsworker.exe ca63d116-a7f5-460a-a828-f7098ead33a9 23f3d62f-17cf-4709-aadf-a90b2ec1493e1⤵PID:4372