Analysis
-
max time kernel
94s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
08/01/2024, 03:40
Behavioral task
behavioral1
Sample
4a5783b883b52012f1b0c2852f4f71c3.exe
Resource
win7-20231215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a5783b883b52012f1b0c2852f4f71c3.exe
Resource
win10v2004-20231222-en
7 signatures
150 seconds
General
-
Target
4a5783b883b52012f1b0c2852f4f71c3.exe
-
Size
661KB
-
MD5
4a5783b883b52012f1b0c2852f4f71c3
-
SHA1
87109375237f028d3a567cd7e0f030619dcc4a05
-
SHA256
21162829c287f0ffacaa0f31372995b2b78c873cea38785b1eaa89c93b33d26a
-
SHA512
c16fecf77e0a404f4d01130b41d1f1cbdf39c6be48436b17744b034e85d446de03f776f55868e3d0e353a3ceeafcfbea477d734de8759f4ccfb2b54cf81694e3
-
SSDEEP
12288:mSI2A2u/WGo+n31k1OxVGL5xLz7MGuU/YuLW4htuM7Cy90Xg:XI72u/WGo41kSGtx37rYuLoyYg
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2600-0-0x0000000001090000-0x0000000001250000-memory.dmp upx behavioral1/memory/2600-3-0x0000000001090000-0x0000000001250000-memory.dmp upx behavioral1/memory/2600-4-0x0000000001090000-0x0000000001250000-memory.dmp upx behavioral1/memory/2600-5-0x0000000001090000-0x0000000001250000-memory.dmp upx behavioral1/memory/2600-8-0x0000000001090000-0x0000000001250000-memory.dmp upx behavioral1/memory/2600-9-0x0000000001090000-0x0000000001250000-memory.dmp upx behavioral1/memory/2600-10-0x0000000001090000-0x0000000001250000-memory.dmp upx behavioral1/memory/2600-11-0x0000000001090000-0x0000000001250000-memory.dmp upx behavioral1/memory/2600-12-0x0000000001090000-0x0000000001250000-memory.dmp upx behavioral1/memory/2600-13-0x0000000001090000-0x0000000001250000-memory.dmp upx behavioral1/memory/1456-14-0x0000000001090000-0x0000000001250000-memory.dmp upx behavioral1/memory/1456-18-0x0000000001090000-0x0000000001250000-memory.dmp upx behavioral1/memory/1456-19-0x0000000001090000-0x0000000001250000-memory.dmp upx behavioral1/memory/1456-25-0x0000000001090000-0x0000000001250000-memory.dmp upx behavioral1/memory/1456-26-0x0000000001090000-0x0000000001250000-memory.dmp upx behavioral1/memory/1456-27-0x0000000001090000-0x0000000001250000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 1456 4a5783b883b52012f1b0c2852f4f71c3.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\4a5783b883b52012f1b0c2852f4f71c3.exe = "11001" 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\4a5783b883b52012f1b0c2852f4f71c3.exe = "11001" 4a5783b883b52012f1b0c2852f4f71c3.exe -
Modifies registry class 44 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\InprocHandler32 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application\CLSID 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\4a5783b883b52012f1b0c2852f4f71c3.exe\"" 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\ = "Setup" 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4a5783b883b52012f1b0c2852f4f71c3.exe" 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967} 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ProxyStubClsid32 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib\Version = "1.0" 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\ProgID 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\FLAGS\ = "0" 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\0 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\0\win32 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\HELPDIR 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\ProgID\ = "Setup.Application" 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\InprocHandler32\ = "ole32.dll" 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib\Version = "1.0" 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application\CLSID 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\HELPDIR\ 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib\ = "{F126C9FC-9299-40F2-BD42-C59023AD1E7F}" 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90} 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\ProgID\ = "Setup.Application" 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\InprocHandler32 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\LocalServer32 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application\CLSID\ = "{017E057B-DACF-4A07-B878-E294565E3F90}" 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\4a5783b883b52012f1b0c2852f4f71c3.exe\"" 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application\CLSID\ = "{017E057B-DACF-4A07-B878-E294565E3F90}" 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\ProgID 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ProxyStubClsid32 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967} 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib\ = "{F126C9FC-9299-40F2-BD42-C59023AD1E7F}" 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Application\ = "Setup.Application" 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F} 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\ = "Setup.Application" 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\InprocHandler32\ = "ole32.dll" 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\TypeLib 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}\1.0\FLAGS 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ = "ISetup" 4a5783b883b52012f1b0c2852f4f71c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}\ = "ISetup" 4a5783b883b52012f1b0c2852f4f71c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{017E057B-DACF-4A07-B878-E294565E3F90}\LocalServer32 4a5783b883b52012f1b0c2852f4f71c3.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 1456 4a5783b883b52012f1b0c2852f4f71c3.exe 1456 4a5783b883b52012f1b0c2852f4f71c3.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 1456 4a5783b883b52012f1b0c2852f4f71c3.exe 1456 4a5783b883b52012f1b0c2852f4f71c3.exe 1456 4a5783b883b52012f1b0c2852f4f71c3.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2600 wrote to memory of 1456 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 32 PID 2600 wrote to memory of 1456 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 32 PID 2600 wrote to memory of 1456 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 32 PID 2600 wrote to memory of 1456 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 32 PID 2600 wrote to memory of 1456 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 32 PID 2600 wrote to memory of 1456 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 32 PID 2600 wrote to memory of 1456 2600 4a5783b883b52012f1b0c2852f4f71c3.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a5783b883b52012f1b0c2852f4f71c3.exe"C:\Users\Admin\AppData\Local\Temp\4a5783b883b52012f1b0c2852f4f71c3.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\4a5783b883b52012f1b0c2852f4f71c3.exe"C:\Users\Admin\AppData\Local\Temp\4a5783b883b52012f1b0c2852f4f71c3.exe" /adm /recovermode2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1456
-