Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 00:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0813143616336dd94a6adfdc63287364.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0813143616336dd94a6adfdc63287364.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
0813143616336dd94a6adfdc63287364.exe
-
Size
211KB
-
MD5
0813143616336dd94a6adfdc63287364
-
SHA1
40fe1cde54bfe4ea7ca160162c46b69b20ae1589
-
SHA256
e07a62364ed40dcb5d12ad4597ddfcf469575d69028f68e1df54cbd4ead598f5
-
SHA512
cd715444b8e98a943b0014f7e6a5d2649ce0ffb28971f14f8f0d46053c623fc33c5fceac376a20461aac1981c1945397f3d548f0695398943401f9e603852c3c
-
SSDEEP
6144:WDYsVX0DxzhCFyOZ6QTO8rtujvhjR/F9NnC:WDYaUEyOEmOqEjJd/FfnC
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Windows Update.exe 0813143616336dd94a6adfdc63287364.exe -
Runs .reg file with regedit 1 IoCs
pid Process 2828 REGEDIT.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe 2808 0813143616336dd94a6adfdc63287364.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2828 2808 0813143616336dd94a6adfdc63287364.exe 31 PID 2808 wrote to memory of 2828 2808 0813143616336dd94a6adfdc63287364.exe 31 PID 2808 wrote to memory of 2828 2808 0813143616336dd94a6adfdc63287364.exe 31 PID 2808 wrote to memory of 2828 2808 0813143616336dd94a6adfdc63287364.exe 31 PID 2808 wrote to memory of 2828 2808 0813143616336dd94a6adfdc63287364.exe 31 PID 2808 wrote to memory of 2828 2808 0813143616336dd94a6adfdc63287364.exe 31 PID 2808 wrote to memory of 2828 2808 0813143616336dd94a6adfdc63287364.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\0813143616336dd94a6adfdc63287364.exe"C:\Users\Admin\AppData\Local\Temp\0813143616336dd94a6adfdc63287364.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\REGEDIT.exeREGEDIT /S C:\WINDOWS\SCANREG01.REG2⤵
- Runs .reg file with regedit
PID:2828
-