Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 18:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0064ab1b9d8481ef0e9febb7626df3e0.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0064ab1b9d8481ef0e9febb7626df3e0.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
0064ab1b9d8481ef0e9febb7626df3e0.exe
-
Size
108KB
-
MD5
0064ab1b9d8481ef0e9febb7626df3e0
-
SHA1
a2a3294bd345c7744d59d08c1472babb26c52411
-
SHA256
6d1b72179e6967067a5e7e01b3cfc89528d4d019edec30728cf4aae2e9a0f1d9
-
SHA512
4f767541198a2a417296a95c0e7837d5fbf24b290eeeca7dea45d59fcefedb5cf381ec9d4acf54a1a439d0e41526ef53ee86599d4c5f0180f316525db3207a41
-
SSDEEP
1536:hisKFwsMjbSCEZpd+V5SdAnfO0Iuy/T3sBZil3eOgoFG0K6Ol:Mwjopdq8+nVIHbIil7gov
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0064AB1B9D8481EF0E9FEBB7626DF3E0 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0064AB1B9D8481EF0E9FEBB7626DF3E0.EXE" 0064ab1b9d8481ef0e9febb7626df3e0.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3196 0064ab1b9d8481ef0e9febb7626df3e0.exe