Analysis
-
max time kernel
145s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 16:47
Behavioral task
behavioral1
Sample
06863201a57ae0b67c8c52e6a6d590c2.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
06863201a57ae0b67c8c52e6a6d590c2.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
06863201a57ae0b67c8c52e6a6d590c2.exe
-
Size
288KB
-
MD5
06863201a57ae0b67c8c52e6a6d590c2
-
SHA1
15cd86fb4f43fe98d1aed0a31b7ac89faa938d23
-
SHA256
18a752643d9c3ce51d860ad8e104987453ee50943462702240573b5d296e56d9
-
SHA512
4ac63e46fd4b69d6e2fb995373d693f65552f3f45204503957e477312a366c45b344a3716e383ef19c7f71e58b3b465ca90ebf862fc184a329fcc9de5106e13d
-
SSDEEP
3072:9lqAqY2hrZIYEPuamp79R5v/H0qwRpqxYICb1i8bExrhhIAIVruL5QMX4aaUKuY6:9l2Y2vIYE0/H0p2ublExxRaUI5QzKFD
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1056-0-0x0000000000400000-0x000000000045A000-memory.dmp vmprotect behavioral1/memory/1056-2-0x0000000000400000-0x000000000045A000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1056 06863201a57ae0b67c8c52e6a6d590c2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main 06863201a57ae0b67c8c52e6a6d590c2.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 06863201a57ae0b67c8c52e6a6d590c2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 06863201a57ae0b67c8c52e6a6d590c2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe 1056 06863201a57ae0b67c8c52e6a6d590c2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06863201a57ae0b67c8c52e6a6d590c2.exe"C:\Users\Admin\AppData\Local\Temp\06863201a57ae0b67c8c52e6a6d590c2.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1056