Analysis
-
max time kernel
26s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/02/2024, 18:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8fde5faceca028fd4221c57a9f0d41eb.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8fde5faceca028fd4221c57a9f0d41eb.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
8fde5faceca028fd4221c57a9f0d41eb.exe
-
Size
167KB
-
MD5
8fde5faceca028fd4221c57a9f0d41eb
-
SHA1
de5b462e4ded93660138fc5d73b9bc05e6a23201
-
SHA256
f00d4b749a68c29964ec50e7c908e3c97b89c4ba33ef0a93f9fc265ff5301756
-
SHA512
db1c41924c90375829f0204858fb42eb4930102057044f1ba759aafe246335184affdac0b6310c72737ca5321025bf55d0bd60ebe694b6f88b449dbe3aaa771d
-
SSDEEP
3072:Q9qNjVVJKuwwZ0fNm5o+JHVsG/NX+0APipCLS0TtnM:JjV2uU8SSmG/NO0MuQtM
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\QNB2EB90WX = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8fde5faceca028fd4221c57a9f0d41eb.exe" 8fde5faceca028fd4221c57a9f0d41eb.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job 8fde5faceca028fd4221c57a9f0d41eb.exe File opened for modification C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job 8fde5faceca028fd4221c57a9f0d41eb.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe 2236 8fde5faceca028fd4221c57a9f0d41eb.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2236 8fde5faceca028fd4221c57a9f0d41eb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fde5faceca028fd4221c57a9f0d41eb.exe"C:\Users\Admin\AppData\Local\Temp\8fde5faceca028fd4221c57a9f0d41eb.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2236