0c35f5b724faaa4d0f4f17f62272610047408b381df876067c98fca735a3682d

Analysis

max time kernel
1713s
max time network
1637s
platform
windows11-21h2_x64
resource
win11-20231129-en
resource tags

arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system
submitted
04-12-2023 17:56

Target

The-MALWARE-Repo-master/Email-Worm/Bugsoft.exe
Size

32KB
MD5

70f549ae7fafc425a4c5447293f04fdb
SHA1

af4b0ed0e0212aced62d40b24ad6861dbfd67b61
SHA256

96425ae53a5517b9f47e30f6b41fdc883831039e1faba02fe28b2d5f3efcdc29
SHA512

3f83e9e6d5bc080fb5c797617078aff9bc66efcd2ffac091a97255911c64995a2d83b5e93296f7a57ff3713d92952b30a06fc38cd574c5fe58f008593040b7f0
SSDEEP

384:/TELevJlARz3z1AWoYbEz3QqRbViB3CoUEmeQo/o2Y0gsjDWK7L:/gLevJlARz3z1AWoYbEz3Ngk6WK7L

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\mail.vbs	Bugsoft.exe
File created	\??\c:\windows\jk.bat	Bugsoft.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4380	Bugsoft.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 3684	4380	Bugsoft.exe	81
PID 4380 wrote to memory of 3684	4380	Bugsoft.exe	81
PID 4380 wrote to memory of 3684	4380	Bugsoft.exe	81

C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Bugsoft.exe
"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Bugsoft.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\jk.bat
  2⤵
  PID:3684

\??\c:\windows\jk.bat

Filesize
3KB

MD5
a725af7c07b52549023be73328e55809

SHA1
c9d8072aaac80f6cf1edfaeaba6c934196631c81

SHA256
e009a52eeb2138531c799905010f7677b0fdd4190abe4ac0a25e0e15eb30d865

SHA512
d4cd904da5c6a5c6112d212b218abc76429da0e4d6382f4fbd9ca51a976eedef26e202607ff6041c4de7e9db783f62e5a24ee560fed068945aef69fa5491a3ce

Download Submit