Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 22:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f2e1a157d47726ab4e286b67537b044.exe
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f2e1a157d47726ab4e286b67537b044.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
1f2e1a157d47726ab4e286b67537b044.exe
-
Size
88KB
-
MD5
1f2e1a157d47726ab4e286b67537b044
-
SHA1
839957f680b88605ee50988435ef5cc701905f7e
-
SHA256
c61c4b8dc1691c0086a1da15657f4ffb01c3948b19996f206b91ebb7a4cbbaf6
-
SHA512
af7656986a66e6d1b3fb294f375a8f270bfbc2b5f089dfedc3d05aea73f418e970140d6d2ac001560279416522d2aeecd93f1074b799ee73db17b06e5b2e1958
-
SSDEEP
1536:9drlE5ELsjqpgRrC2AV9eBsCXKSn44GmANqW7:/6EczRBsYONq2
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2060 set thread context of 2384 2060 1f2e1a157d47726ab4e286b67537b044.exe 14 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2384 1f2e1a157d47726ab4e286b67537b044.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2060 1f2e1a157d47726ab4e286b67537b044.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2384 2060 1f2e1a157d47726ab4e286b67537b044.exe 14 PID 2060 wrote to memory of 2384 2060 1f2e1a157d47726ab4e286b67537b044.exe 14 PID 2060 wrote to memory of 2384 2060 1f2e1a157d47726ab4e286b67537b044.exe 14 PID 2060 wrote to memory of 2384 2060 1f2e1a157d47726ab4e286b67537b044.exe 14 PID 2060 wrote to memory of 2384 2060 1f2e1a157d47726ab4e286b67537b044.exe 14 PID 2060 wrote to memory of 2384 2060 1f2e1a157d47726ab4e286b67537b044.exe 14 PID 2060 wrote to memory of 2384 2060 1f2e1a157d47726ab4e286b67537b044.exe 14 PID 2060 wrote to memory of 2384 2060 1f2e1a157d47726ab4e286b67537b044.exe 14 PID 2060 wrote to memory of 2384 2060 1f2e1a157d47726ab4e286b67537b044.exe 14 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17 PID 2384 wrote to memory of 1400 2384 1f2e1a157d47726ab4e286b67537b044.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f2e1a157d47726ab4e286b67537b044.exeC:\Users\Admin\AppData\Local\Temp\1f2e1a157d47726ab4e286b67537b044.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2384
-
C:\Users\Admin\AppData\Local\Temp\1f2e1a157d47726ab4e286b67537b044.exe"C:\Users\Admin\AppData\Local\Temp\1f2e1a157d47726ab4e286b67537b044.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1400