dd2d1731eb683132876f67414e3102fe4d84d2474ee44e8dee02cdae41e6e01b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

046e6540e567806738977a57a3bcd1cf.exe
Size

251KB
MD5

046e6540e567806738977a57a3bcd1cf
SHA1

a7e7b3d909699211e96ea6325ba8c4ad3fb9ea94
SHA256

dd2d1731eb683132876f67414e3102fe4d84d2474ee44e8dee02cdae41e6e01b
SHA512

5cdca8c9b906c76fa8d850ada27c364556bc84d34d5a65b9e24952348c7f9aad4055f18c31f99e182ff0da8d170f4dc20e4436f07ffe2b439a5428914e2953b4
SSDEEP

6144:vBfosESuJD5MhiL6w1NQA+Bw9AxYyFpT5j0M0m5Vit0iiOl:vBfPUJFneSNvle9jtj0M0m5xla

Score

1^/10

Malware Config

Signatures

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32	046e6540e567806738977a57a3bcd1cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\046e6540e567806738977a57a3bcd1cf.exe"	046e6540e567806738977a57a3bcd1cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\046e6540e567806738977a57a3bcd1cf.MyNSHandler\ = "this is my ebook"	046e6540e567806738977a57a3bcd1cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID\ = "046e6540e567806738977a57a3bcd1cf.MyNSHandler"	046e6540e567806738977a57a3bcd1cf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID	046e6540e567806738977a57a3bcd1cf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}	046e6540e567806738977a57a3bcd1cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ = "this is my ebook"	046e6540e567806738977a57a3bcd1cf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\046e6540e567806738977a57a3bcd1cf.MyNSHandler	046e6540e567806738977a57a3bcd1cf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\046e6540e567806738977a57a3bcd1cf.MyNSHandler\Clsid	046e6540e567806738977a57a3bcd1cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\046e6540e567806738977a57a3bcd1cf.MyNSHandler\Clsid\ = "{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}"	046e6540e567806738977a57a3bcd1cf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1488	046e6540e567806738977a57a3bcd1cf.exe
1488	046e6540e567806738977a57a3bcd1cf.exe

C:\Users\Admin\AppData\Local\Temp\046e6540e567806738977a57a3bcd1cf.exe
"C:\Users\Admin\AppData\Local\Temp\046e6540e567806738977a57a3bcd1cf.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-0-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1488-1-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/1488-2-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/1488-4-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads