d60e5ca6eeb2192106beb658d64f7feaa07e2bab339dfd7dd08de114c2d42067

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 02:38

Target

88559e34bef2095e07c56426e3421395.exe
Size

192KB
MD5

88559e34bef2095e07c56426e3421395
SHA1

8789a395de5270e18b11f46448e99d4cbd2d2b94
SHA256

d60e5ca6eeb2192106beb658d64f7feaa07e2bab339dfd7dd08de114c2d42067
SHA512

cbf505a080c397561d1b9d39cd692f145a9d25e993577dcd6fe64cc88ad7d2c3d756a48f3080cdb2d3d406269cc18482c8b629907cebe3b241e8e0f9be3fd93a
SSDEEP

3072:LaVEAooXUK9AKYkk4/1V15JobX6oklBu+hSPNBz+uTUNO+3akX72WMRDP6GPtCzs:+aAhl10bX6okCOSPzjCP72TD60czB

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2692	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\found.exe	88559e34bef2095e07c56426e3421395.exe
File opened for modification	C:\Windows\SysWOW64\found.exe	88559e34bef2095e07c56426e3421395.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Debug\found32.dll	88559e34bef2095e07c56426e3421395.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18EDD7A0-87EF-45B7-85CF-6A7E1341E2BB}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18EDD7A0-87EF-45B7-85CF-6A7E1341E2BB}\ = "url"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18EDD7A0-87EF-45B7-85CF-6A7E1341E2BB}\InProcServer32	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18EDD7A0-87EF-45B7-85CF-6A7E1341E2BB}\InProcServer32\ = "C:\\Windows\\Debug\\found32.dll"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18EDD7A0-87EF-45B7-85CF-6A7E1341E2BB}\InProcServer32\ThreadingModel = "Apartment"	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2760	regedit.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2324	1700	88559e34bef2095e07c56426e3421395.exe	24
PID 1700 wrote to memory of 2324	1700	88559e34bef2095e07c56426e3421395.exe	24
PID 1700 wrote to memory of 2324	1700	88559e34bef2095e07c56426e3421395.exe	24
PID 1700 wrote to memory of 2324	1700	88559e34bef2095e07c56426e3421395.exe	24
PID 1700 wrote to memory of 2692	1700	88559e34bef2095e07c56426e3421395.exe	23
PID 1700 wrote to memory of 2692	1700	88559e34bef2095e07c56426e3421395.exe	23
PID 1700 wrote to memory of 2692	1700	88559e34bef2095e07c56426e3421395.exe	23
PID 1700 wrote to memory of 2692	1700	88559e34bef2095e07c56426e3421395.exe	23
PID 2324 wrote to memory of 2760	2324	cmd.exe	30
PID 2324 wrote to memory of 2760	2324	cmd.exe	30
PID 2324 wrote to memory of 2760	2324	cmd.exe	30
PID 2324 wrote to memory of 2760	2324	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\88559e34bef2095e07c56426e3421395.exe
"C:\Users\Admin\AppData\Local\Temp\88559e34bef2095e07c56426e3421395.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\88559e34bef2095e07c56426e3421395.exe"
  2⤵
  - Deletes itself
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\fnous.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Users\Admin\AppData\Local\Temp\nothks.reg
    3⤵
    - Modifies registry class
    - Runs .reg file with regedit
    PID:2760

C:\Users\Admin\AppData\Local\Temp\fnous.bat

Filesize
126B

MD5
7ab275c1bc8750fe49119429e12ab856

SHA1
ea556c59c5d3f2be584d2e208ba42a1540f46986

SHA256
8d96bacc0e4651d7b8c27613f3f721bb89ca9fb9430bab66b2ef90bfe8cb5bb3

SHA512
7fe4bce942523a6adde6d83fc2f63302283f3e0642db4f9f650d50ba8f6f2b7b587229736521615d54b596f24a23146ab7aecb512c145b8dc4b81050ac3576c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nothks.reg

Filesize
403B

MD5
e1db5e72383ca2535cc04d98efb0f6e6

SHA1
b3407d394658ad2d4ef59179fd2ddd419a1dc1d7

SHA256
52a9ba0c766a4da941eb674797f1770712e64e2d2104271b4ff6368a45ba5c31

SHA512
6ac5c144d0103b722a7203b04f79b3c691ff1393b59555a7ccd454a10a64e2c60111e9e45dc1fdaa3fdf180fac2b0416250aa0180a946c772bd3f1225c15c095

Download Submit
memory/1700-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1700-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1700-1-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/1700-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download