78d06a5218aaab8ed48a1110c1cd7008703e4c62463fd0dd83d294af7ad403e9 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

26e08d242e829a5fb3cf392cd7349a46.exe
Size

36KB
MD5

26e08d242e829a5fb3cf392cd7349a46
SHA1

d42081aff1150f94393146a13fe97076d677f8c6
SHA256

78d06a5218aaab8ed48a1110c1cd7008703e4c62463fd0dd83d294af7ad403e9
SHA512

1c1c004a264e0bfaef901b6b2a0b385b98b23d6fe79cd2fb81dd63aee9bcf9ed4675b39c992d97e0d418a8571f8d8fe4d7cab4014058dcbfd67fa0b70e7e81fb
SSDEEP

768:zwV7nAl5ZFxHlAl5plCqWg/rKxmEcHBOkIRPJ:z+Al9llAl5CwzemhkPJ

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\helvaxse.txt	26e08d242e829a5fb3cf392cd7349a46.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1152	26e08d242e829a5fb3cf392cd7349a46.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2820	1152	26e08d242e829a5fb3cf392cd7349a46.exe	28
PID 1152 wrote to memory of 2820	1152	26e08d242e829a5fb3cf392cd7349a46.exe	28
PID 1152 wrote to memory of 2820	1152	26e08d242e829a5fb3cf392cd7349a46.exe	28
PID 1152 wrote to memory of 2820	1152	26e08d242e829a5fb3cf392cd7349a46.exe	28
PID 1152 wrote to memory of 2820	1152	26e08d242e829a5fb3cf392cd7349a46.exe	28
PID 1152 wrote to memory of 2820	1152	26e08d242e829a5fb3cf392cd7349a46.exe	28
PID 1152 wrote to memory of 2820	1152	26e08d242e829a5fb3cf392cd7349a46.exe	28

C:\Users\Admin\AppData\Local\Temp\26e08d242e829a5fb3cf392cd7349a46.exe
"C:\Users\Admin\AppData\Local\Temp\26e08d242e829a5fb3cf392cd7349a46.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s msmask32.ocx
  2⤵
  PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads