Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26-01-2024 12:13
Behavioral task
behavioral1
Sample
7752e819b53295bbf21a58f1b8827ce8.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
General
-
Target
7752e819b53295bbf21a58f1b8827ce8.exe
-
Size
2.8MB
-
MD5
7752e819b53295bbf21a58f1b8827ce8
-
SHA1
f1ce6d2ffbc2cc56a5548ef3cf681b60727d22b0
-
SHA256
149982fc0b5a54877112c6f02b6def714704edc264b3f14dd28b16e9ba6bd2dc
-
SHA512
ff2bddecc260536d4fcb30ade979de049636d4c387aae17811a2b4a129c6bfa25d2a7fc664f552099342f29f0efa5bb7b6084067a094930b27a05f3ad1e4f109
-
SSDEEP
49152:VxGRDUd0qD5LX2wgJSA6mA9AvtnPo13zx3NVwT8rm9opIeZvs0IT5sCpEejPvGKE:eRA1VmSA7vtnwdgT8QopIelBI+CpEej6
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2008-0-0x0000000000400000-0x0000000000C53000-memory.dmp upx behavioral2/memory/2008-3-0x0000000000400000-0x0000000000C53000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}\ = "DynamicNS" 7752e819b53295bbf21a58f1b8827ce8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}\LocalServer32 7752e819b53295bbf21a58f1b8827ce8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7752e819b53295bbf21a58f1b8827ce8.exe" 7752e819b53295bbf21a58f1b8827ce8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7752e819b53295bbf21a58f1b8827ce8.DynamicNS\Clsid 7752e819b53295bbf21a58f1b8827ce8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80} 7752e819b53295bbf21a58f1b8827ce8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\7752e819b53295bbf21a58f1b8827ce8.DynamicNS 7752e819b53295bbf21a58f1b8827ce8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\7752e819b53295bbf21a58f1b8827ce8.DynamicNS\ = "DynamicNS" 7752e819b53295bbf21a58f1b8827ce8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\7752e819b53295bbf21a58f1b8827ce8.DynamicNS\Clsid\ = "{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}" 7752e819b53295bbf21a58f1b8827ce8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}\ProgID 7752e819b53295bbf21a58f1b8827ce8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}\ProgID\ = "7752e819b53295bbf21a58f1b8827ce8.DynamicNS" 7752e819b53295bbf21a58f1b8827ce8.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2008 7752e819b53295bbf21a58f1b8827ce8.exe 2008 7752e819b53295bbf21a58f1b8827ce8.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2008 7752e819b53295bbf21a58f1b8827ce8.exe 2008 7752e819b53295bbf21a58f1b8827ce8.exe