9196c41c4e14f98f88e8751b9509c21a8bb297ea1f1c3a672619d2fb179ab669 | Triage

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 18:41

Sharing

Report Analysis Logs

General

Target

cvery.com/32bssx.exe
Size

770KB
MD5

373f1df557289456562deb5e0b423c9e
SHA1

26209be00a0ef1c0583f534089e6db032393627e
SHA256

d1f7ea61f9aa05a45ee955668794523bfd46aeb6556543403eb78dddcb96b8fd
SHA512

beb4780c6f85ab4f3a787bd705716e88a3e744bf3367480376c06033ac787b028b2b3ccea3c07e49f730d3284dfcc9081099fcbb05cd718df076310a118b9abf
SSDEEP

24576:gUhKphemL20wpL2l+TUWEIhUqNgPFfs9Dima9pofOCo:Vq80wpgcNEIhFgn8fOCo

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4976	INSTALL.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4976	INSTALL.EXE
4976	INSTALL.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 4976	4484	32bssx.exe	87
PID 4484 wrote to memory of 4976	4484	32bssx.exe	87
PID 4484 wrote to memory of 4976	4484	32bssx.exe	87

C:\Users\Admin\AppData\Local\Temp\cvery.com\32bssx.exe
"C:\Users\Admin\AppData\Local\Temp\cvery.com\32bssx.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Temp\WZS6736.tmp\INSTALL.EXE
  INSTALL.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WZS6736.tmp\INSTALL.EXE

Filesize
328KB

MD5
22c963af3685b908e0fe019c20976d46

SHA1
2ee70423dc64e2d090f5f89483fd4869e02c136b

SHA256
c709348be94dd34bb12814a0018981b81bd87373c7d50afaa92e4a827d4f929b

SHA512
68c18f3643ddd754fac87cc5ed3b660a9166cbc2137456241a28990db870f685481436d2b6888ab6679ce6ebfae8af179fca75ca3011ec7eb9962a343dfac953

Download Submit