Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 10:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7cee911355bf36e2bc1a9ebe01c88a26.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
7cee911355bf36e2bc1a9ebe01c88a26.exe
Resource
win10v2004-20231215-en
5 signatures
150 seconds
General
-
Target
7cee911355bf36e2bc1a9ebe01c88a26.exe
-
Size
131KB
-
MD5
7cee911355bf36e2bc1a9ebe01c88a26
-
SHA1
62d6ff996e43782f15bc5e5cbe428a510e690e18
-
SHA256
e2bb71020bc856324da004ee0f172b31adb191c1f6e0644723d66157e96f14a2
-
SHA512
2b8c1a6419a62cd6bb488f8d073d38ab8c679a7eaeedd476cf8c077f114b8f27223ed67f5ad946dada3ce0e11399714d05bf3fc9913255fd6755223bb8b61803
-
SSDEEP
3072:wQFHCS3oIU157MVbHtLnWWyqMdyrOjUlrCOTzffu6J2N7o9x:wQwS9tHtD3bMdGuIz3u22N+
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\CE8SIIFGSU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7cee911355bf36e2bc1a9ebe01c88a26.exe" 7cee911355bf36e2bc1a9ebe01c88a26.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job 7cee911355bf36e2bc1a9ebe01c88a26.exe File opened for modification C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job 7cee911355bf36e2bc1a9ebe01c88a26.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main 7cee911355bf36e2bc1a9ebe01c88a26.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International 7cee911355bf36e2bc1a9ebe01c88a26.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe 3056 7cee911355bf36e2bc1a9ebe01c88a26.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cee911355bf36e2bc1a9ebe01c88a26.exe"C:\Users\Admin\AppData\Local\Temp\7cee911355bf36e2bc1a9ebe01c88a26.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3056