9d818f7fd9a529dbe3e33cc714955a3da90297e69478e06ff6823ec348af38d9

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:17

Target

169b254c9319e862071299cd95edf838.exe
Size

27KB
MD5

169b254c9319e862071299cd95edf838
SHA1

2ec0062e51ff9e14b6235574fa390b6e5a97775a
SHA256

9d818f7fd9a529dbe3e33cc714955a3da90297e69478e06ff6823ec348af38d9
SHA512

1c5878380d2d55b7a7753648c6c34aa06974dba0220b58ee8c803138c8328d06453fc6bd9e9660a5895873dd9886f5022ae4ff088f2d78ef0401a773b43177a1
SSDEEP

384:n7baB9KDUvYhFmbgght2NbO6TfrOIF2ykNrmUMhTV2Chb1pCc5SMbkYDb84MRtQ+:n7LDJFmXaq8rzLkWV2ChpDb8jQ13E

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1692-0-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/1692-1-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\PLUGINS\system.jmp	169b254c9319e862071299cd95edf838.exe
File opened for modification	C:\Program Files\Internet Explorer\PLUGINS\system.jmp	169b254c9319e862071299cd95edf838.exe
File created	C:\Program Files\Internet Explorer\PLUGINS\system16.sys	169b254c9319e862071299cd95edf838.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E44887F-5214-41F2-AB46-4728735C4CC6}\	169b254c9319e862071299cd95edf838.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E44887F-5214-41F2-AB46-4728735C4CC6}\InProcServer32	169b254c9319e862071299cd95edf838.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E44887F-5214-41F2-AB46-4728735C4CC6}\InProcServer32\ = "C:\\Program Files\\Internet Explorer\\PLUGINS\\system16.sys"	169b254c9319e862071299cd95edf838.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E44887F-5214-41F2-AB46-4728735C4CC6}\InProcServer32\ThreadingModel = "Apartment"	169b254c9319e862071299cd95edf838.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E44887F-5214-41F2-AB46-4728735C4CC6}	169b254c9319e862071299cd95edf838.exe

memory/1692-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1692-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download