Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 07:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
64dbc52587aeb817396de5b6b41d8b5c.exe
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
64dbc52587aeb817396de5b6b41d8b5c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
64dbc52587aeb817396de5b6b41d8b5c.exe
-
Size
36KB
-
MD5
64dbc52587aeb817396de5b6b41d8b5c
-
SHA1
9edf3b805272fcb201a0ad2643bbeee919e3e99b
-
SHA256
7593d1921ddcd3bb8301e2156d8e891cb9ea948329ef1dd5c5348c624b6fc1c9
-
SHA512
b86c8d193d4188f25aede5021f7ed7ee88d1b58f99e8e5e976d112b5f2b972cd09c027032ebf86033f5dfcc475e7a076c955937e6b59522985ff4f7ee2e78973
-
SSDEEP
384:ciTkVaoudKqF6HERHcQmi8J6KW7BNoEUZI5Kt:ciTCPudKhqHcQmi5qIAt
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\svers.dll 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\SysWOW64\dll\csrss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\SysWOW64\srsver.dll 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\SysWOW64\rsver.dll 64dbc52587aeb817396de5b6b41d8b5c.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\img32\services.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\winsyst.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\dll\services.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\Mscom32.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\wsdll32.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\spool\lsass.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\comp.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\MsDtc\services.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\vts\smss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\display\smss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\debug64\services.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\vts\services.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\svchost.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\outlook.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\Msapp.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\vzones\services.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\AR.dll 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\ShellExt\services.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\msn64.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\OutlookExpress.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\msapps\csrss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\drivers\smss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\vdzones\lsass.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\winup32.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\ARTemp.dll 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\winvid.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\data\csrss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\data\services.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\img32\csrss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\msapps\services.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\MsDtc\smss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\debug64\smss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\isas\smss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\ex.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\msimn.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\msim32.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\spool\cmss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\auto32.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\enco.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\ShellExt\smss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\OSdebug\services.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\msn.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\makensis.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\rsver.dll 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\Outlook32.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\dhcp\smss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\dllcache\smss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\rpool\smss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\msndebug\lsass.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\svers.dll 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\ziplogs\services.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\zip\services.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\services.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\taskmgr.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\vzones\smss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\dll32.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\misi.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\zip\csrss.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\dllcache\services.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\display\services.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\uninse.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\comm.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\DX.exe 64dbc52587aeb817396de5b6b41d8b5c.exe File opened for modification C:\Windows\winusers.exe 64dbc52587aeb817396de5b6b41d8b5c.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1576 64dbc52587aeb817396de5b6b41d8b5c.exe -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0" 64dbc52587aeb817396de5b6b41d8b5c.exe