Analysis
-
max time kernel
3s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29-12-2023 21:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0420ffcccfcad64d7cf9147f316dcb48.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0420ffcccfcad64d7cf9147f316dcb48.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
0420ffcccfcad64d7cf9147f316dcb48.exe
-
Size
168KB
-
MD5
0420ffcccfcad64d7cf9147f316dcb48
-
SHA1
889b687db0df51bfd9f2e025be870950215a6b19
-
SHA256
c6329824a51ce54b4fbbcb907a512cdbee20768ffb659e1990180379749bc402
-
SHA512
8d2faf6e5a81fcab2cc62159e03974ec9c8b1eb0518ba65b1d0e38e904dee0eb44b70e6663a064057a4629fa022ebe93cc0379c74443fdb8c509d1d9d00a036f
-
SSDEEP
3072:Jw0P22sUgbIHSHZiEBrDFZd+QnAFHBdTxf9YulMyLPLg:5FOMSDFuQuHTTBBMybLg
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\EBUNWVLUMV = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0420ffcccfcad64d7cf9147f316dcb48.exe" 0420ffcccfcad64d7cf9147f316dcb48.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job 0420ffcccfcad64d7cf9147f316dcb48.exe File opened for modification C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job 0420ffcccfcad64d7cf9147f316dcb48.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 824 0420ffcccfcad64d7cf9147f316dcb48.exe 824 0420ffcccfcad64d7cf9147f316dcb48.exe 824 0420ffcccfcad64d7cf9147f316dcb48.exe 824 0420ffcccfcad64d7cf9147f316dcb48.exe 824 0420ffcccfcad64d7cf9147f316dcb48.exe 824 0420ffcccfcad64d7cf9147f316dcb48.exe 824 0420ffcccfcad64d7cf9147f316dcb48.exe 824 0420ffcccfcad64d7cf9147f316dcb48.exe 824 0420ffcccfcad64d7cf9147f316dcb48.exe 824 0420ffcccfcad64d7cf9147f316dcb48.exe 824 0420ffcccfcad64d7cf9147f316dcb48.exe 824 0420ffcccfcad64d7cf9147f316dcb48.exe 824 0420ffcccfcad64d7cf9147f316dcb48.exe 824 0420ffcccfcad64d7cf9147f316dcb48.exe 824 0420ffcccfcad64d7cf9147f316dcb48.exe 824 0420ffcccfcad64d7cf9147f316dcb48.exe