fb844d1a9ecefc7acda00fe264ffd50cf37952a5ccd305e48a59ca31e680b41d | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

395ae23e0ece3e80423f26ab11c96328.exe
Size

19KB
MD5

395ae23e0ece3e80423f26ab11c96328
SHA1

eddef9b261c5aee1f6b8b9685f3a2080baa307d1
SHA256

fb844d1a9ecefc7acda00fe264ffd50cf37952a5ccd305e48a59ca31e680b41d
SHA512

ee9cd57664084da67c6fadab65654b8b1a7fe941c4ce687fe5789254aaac48239d309ff621feec07a9211a1319352cf31fbd76fe005f746f28a5cb7961347792
SSDEEP

384:C0erw7jgAcmcLB2ACvirD1dtX3NNsY1sSc+:/FlMLB2A2i3FX3NNpI

Score

8^/10

evasion upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3152-0-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/3152-3-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Modifies registry class 7 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\PersistentHandler	395ae23e0ece3e80423f26ab11c96328.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	395ae23e0ece3e80423f26ab11c96328.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ShellEx	395ae23e0ece3e80423f26ab11c96328.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\.pdf	395ae23e0ece3e80423f26ab11c96328.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithList\AcroRd32.exe	395ae23e0ece3e80423f26ab11c96328.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithList	395ae23e0ece3e80423f26ab11c96328.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\.pdf\OpenWithProgids	395ae23e0ece3e80423f26ab11c96328.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3152	395ae23e0ece3e80423f26ab11c96328.exe

C:\Users\Admin\AppData\Local\Temp\395ae23e0ece3e80423f26ab11c96328.exe
"C:\Users\Admin\AppData\Local\Temp\395ae23e0ece3e80423f26ab11c96328.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3152-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3152-3-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download