Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 04:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0eb4b03b9fc553791f7078870836fb2c.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0eb4b03b9fc553791f7078870836fb2c.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
0eb4b03b9fc553791f7078870836fb2c.exe
-
Size
356KB
-
MD5
0eb4b03b9fc553791f7078870836fb2c
-
SHA1
ef8aa0da15176366286d4830e34577b6bf7a591a
-
SHA256
9ca38ba1f57e2dbf2c2a3b1213909a92a66c61ad8a621ac226daa89dfd4344d0
-
SHA512
8c4b1e0198dd6adc6e09083067898714159ff5882b0215e8272ea7559c5b1ad81f4e78698405586ea6b18dc7c5818264cdb4a700d59fba3ca633a7927d7245cd
-
SSDEEP
6144:rCZdoWQraOrMEYySS1RYsPp/C62fZjE6t/MruhcRGrCQG+3:8OGLgdRpYNE6t/MYcIu
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\defender = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0eb4b03b9fc553791f7078870836fb2c.exe" 0eb4b03b9fc553791f7078870836fb2c.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3024 0eb4b03b9fc553791f7078870836fb2c.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3024 0eb4b03b9fc553791f7078870836fb2c.exe 3024 0eb4b03b9fc553791f7078870836fb2c.exe 3024 0eb4b03b9fc553791f7078870836fb2c.exe