9b3761c3df949b91911db7ba0c8ba2f82de786fc7cad2be9b4a97520bc8c91ed

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 01:29

Target

8de01dc528a4ebf3afd7b6b2a0f9c315.exe
Size

40KB
MD5

8de01dc528a4ebf3afd7b6b2a0f9c315
SHA1

3250d56f2a04d217ccec5733607693f261d893bb
SHA256

9b3761c3df949b91911db7ba0c8ba2f82de786fc7cad2be9b4a97520bc8c91ed
SHA512

192e2b3e85652a03261808bb097ed3a975a768bc4bd3bb40bb5b32242d889fbb62db6bc9e05067a4501989c598700498f9158281a11e86fca4c80992010b655e
SSDEEP

768:uC/rYzAb4lRGHbdfMjAI4Rnd2LtcQkQ9avQxaiKP9IVC83GA0u41xCUL:uiczAb4lR6drRndpzQ9iQx9oakAGRXwa

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2824	8de01dc528a4ebf3afd7b6b2a0f9c315.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2824-8-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2824-9-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\3134EA98.dat	8de01dc528a4ebf3afd7b6b2a0f9c315.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\3134EA98.dll	8de01dc528a4ebf3afd7b6b2a0f9c315.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\3134EA98.dll	8de01dc528a4ebf3afd7b6b2a0f9c315.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\3134EA98.dat	8de01dc528a4ebf3afd7b6b2a0f9c315.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Help\wshmcepts.chm	8de01dc528a4ebf3afd7b6b2a0f9c315.exe
File opened for modification	C:\Windows\Help\wshmcepts.chm	8de01dc528a4ebf3afd7b6b2a0f9c315.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EA93134-3134-EA98-34EA-134A9134EA98}	8de01dc528a4ebf3afd7b6b2a0f9c315.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EA93134-3134-EA98-34EA-134A9134EA98}\	8de01dc528a4ebf3afd7b6b2a0f9c315.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EA93134-3134-EA98-34EA-134A9134EA98}\InProcServer32	8de01dc528a4ebf3afd7b6b2a0f9c315.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EA93134-3134-EA98-34EA-134A9134EA98}\InProcServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\MSINFO\\3134EA98.dll"	8de01dc528a4ebf3afd7b6b2a0f9c315.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EA93134-3134-EA98-34EA-134A9134EA98}\InProcServer32\ThreadingModel = "Apartment"	8de01dc528a4ebf3afd7b6b2a0f9c315.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2824	8de01dc528a4ebf3afd7b6b2a0f9c315.exe

\Program Files\Common Files\Microsoft Shared\MSInfo\3134EA98.dll

Filesize
59KB

MD5
b920f51e71f799ec9505f8a126b0c772

SHA1
8e3d9154a0ba45f3cc904c85957319e7015ad74c

SHA256
5945e3b3a9dc7a209e349d9e63bc1d38258d290aeaede7bb640cf013183abc6d

SHA512
137b53be742deb0afad6dedc0d54a932d4d77924a7b14b6cbef06966d7d1f95061f5eef68195abc3b586cb6392574f6fcd6cbb2a87e77cf6c7343c172528302a

Download Submit
memory/2824-8-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2824-9-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download