48e59ea44609d9b06d0c7cede80086e5ffe45f7e88c5298d0d831efef4fe6e94

Analysis

max time kernel
1477s
max time network
1497s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
31/12/2023, 05:10

Target
Animate3D.exe
Size 261KB
Sample231231-ftw62scga3
SHA256 48e59ea44609d9b06d0c7cede80086e5ffe45f7e88c5298d0d831efef4fe6e94
MD5 a4a2459852e958ebffdf1e9bc1b6db3e
SHA1 56e43d2ea3a4a2c7df6d51e9fb8f6b927d33b35a
SHA512 ae1eb70b3b1d39a40522b6e79da32babff0f8287a6b5aba91a52d2d6da216840eec8d05ceb844d832eb3ad62bc72d9389d64f65f66f9eab77d4ce30e126bce92
SSDEEP 3072:R1px/GNCUfxfyB/FlEFWgxrG6I626KJcburUgbByICcYHGzY/fnPxFNYEIiu:R1kKJM7xr2cb67EmzY/fnpFNYhN
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ripsf\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Icon.ico"	Animate3D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ripsf\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Animate3D.exe\" \"%1\""	Animate3D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ripsf	Animate3D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ripsf\ = "Sketchfab Ripper"	Animate3D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ripsf\URL Protocol	Animate3D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ripsf\shell	Animate3D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ripsf\shell\open	Animate3D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ripsf\shell\open\command	Animate3D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ripsf\ = "ripsf"	Animate3D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ripsf\Content Type = "application/x-ripsf"	Animate3D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ripsf\DefaultIcon	Animate3D.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3916	Animate3D.exe