Analysis
- max time kernel
149s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
26/01/2024, 12:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
776a69c69ba36b2d1dc20fa496408149.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
776a69c69ba36b2d1dc20fa496408149.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
- Target 776a69c69ba36b2d1dc20fa496408149.exe
- Size 457KB
- Sample240126-p63zssfeep
- SHA256 459a0fc27f411c85aebb15bfb392bd0be478fed73d8e6e7dfeb6ec4944652065
- MD5 776a69c69ba36b2d1dc20fa496408149
- SHA1 464d791b9929810feef927586419fb1aa5983e9a
- SHA512 259e20711025dea4133aa9f8fda9059f4d368cf1c568978f02b9f51466845f1212b409c74a0bc20a4de921498a066320b72fac0f59f9dec392ba8455480e6f74
- SSDEEP 12288:5HARVCLEH1bavWkkloye7ZqKMV76Q79VaAxV:5gjDlavWQH7ZGZd9VaA
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\Winuser.exe" 776a69c69ba36b2d1dc20fa496408149.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Winuser.ini 776a69c69ba36b2d1dc20fa496408149.exe File created C:\Windows\Winuser.exe 776a69c69ba36b2d1dc20fa496408149.exe File opened for modification C:\Windows\Winuser.exe 776a69c69ba36b2d1dc20fa496408149.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 220 776a69c69ba36b2d1dc20fa496408149.exe