5ab65dec1c7cc7dfd104388e6c4538a0c6d748742bb4126b8634615e5639168a | Triage

Analysis

max time kernel
121s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 08:58

Sharing

Report Analysis Logs

General

Target

ipchanger/4.exe
Size

36KB
MD5

dc463e371abdeffa42cf739fccd7591b
SHA1

c480ba1a718d098cb0dadb4b2246046f9214bb65
SHA256

60ed463eee94e14774b010dbe38aaeee3c301be8b9473f740b1693324667e10b
SHA512

71d085d2782f6b7d3b62f67b8e11d9bf805c0043534fb7e3987cba800dfea80d8ddaf5e107e606c5299e89fd1ab863b7183bf9b473df9fcea7c355122aac5a31
SSDEEP

384:FsUi0Z4F7OlXVCnhwv/jYnC9oWb3eOaq9/21UWU2B22CDw423ogFqi0Z:Fti7tnUEo21UvykB5xi

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2692	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2252	4.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2692	2252	4.exe	29
PID 2252 wrote to memory of 2692	2252	4.exe	29
PID 2252 wrote to memory of 2692	2252	4.exe	29
PID 2252 wrote to memory of 2692	2252	4.exe	29
PID 2252 wrote to memory of 2692	2252	4.exe	29
PID 2252 wrote to memory of 2692	2252	4.exe	29
PID 2252 wrote to memory of 2692	2252	4.exe	29

C:\Users\Admin\AppData\Local\Temp\ipchanger\4.exe
"C:\Users\Admin\AppData\Local\Temp\ipchanger\4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ipchanger\..\unin.bat
  2⤵
  - Deletes itself
  PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\unin.bat

Filesize
306B

MD5
aba390a3d572fb36dc8750aa3cca774a

SHA1
b3c818f7a7498a6b0971b1e8fdbd6d4b97c41e77

SHA256
a0dbebdf081c33fe3a71871500c0cdeac3c175d65ecb10469110bd93d76b42b0

SHA512
1b45dcff535918600b0421cc1a5e8830c7f8baef07d90fa286ae4e131db195016f23f292e580288b96f325c3816e56c3eb90b91877270b4f1496dce997075377

Download Submit