79f3d4ffcb38a0d20454ecaca60bfc0427c0595489c26ddf4304ac40b42448ba

Analysis

max time kernel
0s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:57

Target

02697866ed322eac1cb757a574089ba6.exe
Size

92KB
MD5

02697866ed322eac1cb757a574089ba6
SHA1

3393b1f22f447e21d8f417c5e45f200091091e1a
SHA256

79f3d4ffcb38a0d20454ecaca60bfc0427c0595489c26ddf4304ac40b42448ba
SHA512

0c2f818bd62c1ea493a95e80b37b7096b35dab5c8f23361c33b2a7d66c4788db53e5520a6958532cd06e4e2938eef2f7b8871db1936d0899eb4409b0abb4d8fe
SSDEEP

768:7TToLE6M/M50JMsXDM9NtNrBDsX9Mix489Et78XKTTo1:7TToLE6M/M5Katwdx4MEWaTTo1

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/860-0-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/860-8-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\userid.txt	02697866ed322eac1cb757a574089ba6.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4728	regedit.exe

Suspicious use of SetWindowsHookEx 3 IoCs

C:\Users\Admin\AppData\Local\Temp\02697866ed322eac1cb757a574089ba6.exe
"C:\Users\Admin\AppData\Local\Temp\02697866ed322eac1cb757a574089ba6.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:860
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Program Files\hf\dllilfoh.dll"
  2⤵
  PID:3344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c regedit.exe /s C:\Windows\reg.reg
  2⤵
  PID:2624

C:\Windows\SysWOW64\regedit.exe
regedit.exe /s C:\Windows\reg.reg
1⤵
- Runs .reg file with regedit
PID:4728

C:\Program Files\hf\dllilfoh.dll

Filesize
18KB

MD5
40cf657b1a2c67109e9ecf374da8cc28

SHA1
d134df662ec1c10e14864b1778ca2c39d4880ce9

SHA256
0749c645f70d169db8165958d74406f1589e4763c7205ccd780c9bcb27a03b10

SHA512
cee3d38aad8344c83f2fcde6f067c3e874f16e55e89989589d319103f4c50e9bf1d1e13a1571aed5031f6b4c48997c8c61c552e9850addba084e1e124c2a150d

Download Submit
C:\Program Files\hf\dllilfoh.dll

Filesize
32KB

MD5
bf41207ec87014150c2f884bcb6a15b3

SHA1
4abb6e0088a7f6408a549ffdab97be173531fdf5

SHA256
fd1f06dc1751f222e1f2a4442c9f45a333aee5169cba688616ca8e1f889a8dc6

SHA512
c1ab38637e9755dcb5d061260c0748443e5682bcd33b911e9638a0e11fc7e31414387809ded59928edad685ed985865e29762fb5f534fd193ea964e1f1bea17d

Download Submit
C:\Windows\reg.reg

Filesize
185B

MD5
12bd717417516054ab1e182a063055b7

SHA1
d25ff40c376e932372a5c562ba8061ead8468519

SHA256
6abe4d60e1dfbfabf5f53a170fce0a0675c45892c4cda089d2ef262c81171e2b

SHA512
e5feabe7a7d24d0e6e0fd63662897100e17e01ac5a72c9df2002a694b705b5ad7ed0c0dfa1b50f0740400fcfdcddaba189f99038d29a841381f95ceda923c7b2

Download Submit
memory/860-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/860-8-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download