Analysis
-
max time kernel
150s -
max time network
77s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
21/11/2023, 10:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
packy.exe
Resource
win7-20231023-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
packy.exe
Resource
win10-20231020-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
packy.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
packy.exe
-
Size
20KB
-
MD5
f8bfaf0d65a295ca33ebf4be63457588
-
SHA1
d8bba0a431c18a52d0745a8d5f17e92d8768cf0a
-
SHA256
4786322b7f2ec05b480bd0f11b3380bdc2ff171147dc3dcf004ae1dc18816e15
-
SHA512
9ae269c19ef19547bbf4ef4184ed1e628b12c72c0607fc69903973c028cdea49b27b3254d7b7226e7c36281fcf9cb5fe6c94bcab3ff6c3e6841bc40d30ef7a00
-
SSDEEP
384:c/zWJQbBAJ/GZzUUj132wCSCTqWXJIm0RZyBOS2zUAONplmXLGqIxnCWD:kWWg/GVZWVTqs8cOS2dglKLGq8n
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 3132 Process not Found 4576 Process not Found 1528 Process not Found 1420 Process not Found 4528 Process not Found 2628 Process not Found 1980 Process not Found 1120 Process not Found 3456 Process not Found 4956 Process not Found 3436 Process not Found 2140 Process not Found 360 Process not Found 2168 Process not Found 1544 Process not Found 4000 Process not Found 3128 Process not Found 3888 Process not Found 2904 Process not Found 4708 Process not Found 4556 Process not Found 1772 Process not Found 1648 Process not Found 3608 Process not Found 3172 Process not Found 1768 Process not Found 4464 Process not Found 3452 Process not Found 3736 Process not Found 4936 Process not Found 1700 Process not Found 420 Process not Found 1408 Process not Found 2068 Process not Found 1312 Process not Found 1516 Process not Found 436 Process not Found 5068 Process not Found 4608 Process not Found 4984 Process not Found 1316 Process not Found 4420 Process not Found 5088 Process not Found 8 Process not Found 3620 Process not Found 516 Process not Found 1044 Process not Found 2364 Process not Found 3328 Process not Found 2336 Process not Found 4204 Process not Found 3088 Process not Found 4148 Process not Found 1844 Process not Found 1552 Process not Found 2028 Process not Found 1936 Process not Found 4620 Process not Found 2012 Process not Found 4844 Process not Found 2196 Process not Found 3156 Process not Found 3160 Process not Found 5040 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4152 LogonUI.exe