Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
12/12/2023, 17:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
440FBCCE51DB45299987C063B177D6E2.exe
Resource
win7-20231201-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
440FBCCE51DB45299987C063B177D6E2.exe
Resource
win10v2004-20231127-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
440FBCCE51DB45299987C063B177D6E2.exe
-
Size
253KB
-
MD5
440fbcce51db45299987c063b177d6e2
-
SHA1
c9abfe0791bef9ccdbf65c0aca2918fce2bfd0e4
-
SHA256
29c719c4524eac3b78e4240666b0f8fb7f23dafc559f47fc32087576197aaf27
-
SHA512
4752289599356c4e6544aa5e0e56b58bfcccf07226fc1f93e13b775c4b1ac6e44338d6c4f6ef172d095d76eb21506cbbdb7a418b265d267289c217029e989b63
-
SSDEEP
6144:Luk3SHEXJPSjiVJGZKZjwdFUcbZLSlHBNSem+tT9PTBHdo27D:Lv3Sk5PSmVGKZ8CHBN1mcT9PT/
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\S: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\X: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\Z: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\G: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\I: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\J: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\T: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\U: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\Y: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\O: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\P: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\Q: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\W: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\B: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\R: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\V: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\M: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\N: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\E: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\H: 440FBCCE51DB45299987C063B177D6E2.exe File opened (read-only) \??\L: 440FBCCE51DB45299987C063B177D6E2.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 440FBCCE51DB45299987C063B177D6E2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 440FBCCE51DB45299987C063B177D6E2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe 1928 440FBCCE51DB45299987C063B177D6E2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1928 440FBCCE51DB45299987C063B177D6E2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1928 440FBCCE51DB45299987C063B177D6E2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\440FBCCE51DB45299987C063B177D6E2.exe"C:\Users\Admin\AppData\Local\Temp\440FBCCE51DB45299987C063B177D6E2.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1928