Analysis
-
max time kernel
190s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 03:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c64bc2a1c9496181e79c3aa75445b41.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c64bc2a1c9496181e79c3aa75445b41.exe
Resource
win10v2004-20231215-en
5 signatures
150 seconds
General
-
Target
0c64bc2a1c9496181e79c3aa75445b41.exe
-
Size
1.7MB
-
MD5
0c64bc2a1c9496181e79c3aa75445b41
-
SHA1
80fd654d987bc9dec2fc17e2a505167c7ca55e94
-
SHA256
5b210b801613f51262f0d2fcefdb5bfa57515b4b30cdced418eaf54a49c781d9
-
SHA512
7e140679b6fbd15f94773a661ac59f40e2aad9aadce40778ff4d05ad24923d5da578f04561731b7652019a41fcbf41367f3c958cce13ede34ea2fea322eac4a8
-
SSDEEP
49152:E6Puvkka04IgQcbGoCSw4EDnPiCLM3bhVPaS:8ZVLo2CF3b/
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0c64bc2a1c9496181e79c3aa75445b41.exe" 0c64bc2a1c9496181e79c3aa75445b41.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0c64bc2a1c9496181e79c3aa75445b41.exe" 0c64bc2a1c9496181e79c3aa75445b41.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 3860 0c64bc2a1c9496181e79c3aa75445b41.exe 3860 0c64bc2a1c9496181e79c3aa75445b41.exe 3860 0c64bc2a1c9496181e79c3aa75445b41.exe 3860 0c64bc2a1c9496181e79c3aa75445b41.exe 3860 0c64bc2a1c9496181e79c3aa75445b41.exe 3860 0c64bc2a1c9496181e79c3aa75445b41.exe 3860 0c64bc2a1c9496181e79c3aa75445b41.exe 3860 0c64bc2a1c9496181e79c3aa75445b41.exe 3860 0c64bc2a1c9496181e79c3aa75445b41.exe 3860 0c64bc2a1c9496181e79c3aa75445b41.exe 3860 0c64bc2a1c9496181e79c3aa75445b41.exe 3860 0c64bc2a1c9496181e79c3aa75445b41.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3860 0c64bc2a1c9496181e79c3aa75445b41.exe 3860 0c64bc2a1c9496181e79c3aa75445b41.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3860 0c64bc2a1c9496181e79c3aa75445b41.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3860 0c64bc2a1c9496181e79c3aa75445b41.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c64bc2a1c9496181e79c3aa75445b41.exe"C:\Users\Admin\AppData\Local\Temp\0c64bc2a1c9496181e79c3aa75445b41.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3860