Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11-02-2024 23:59
Static task
static1
Behavioral task
behavioral1
Sample
95b5a931740d780c4af7bb33b0a33b2a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
95b5a931740d780c4af7bb33b0a33b2a.exe
Resource
win10v2004-20231222-en
General
-
Target
95b5a931740d780c4af7bb33b0a33b2a.exe
-
Size
910KB
-
MD5
95b5a931740d780c4af7bb33b0a33b2a
-
SHA1
d6edbbc626b95b1fdd7a31e2de92f84a70336919
-
SHA256
c5daf84f93ea2bf15f6443037cacf2109cf7ac07b1cca9d8bfe3d54f7a5001e9
-
SHA512
6b1880900598795d0380521e7b846d3cfa0a2a7da9c3c8d1e0b66481323d065f10353d6395e06c40c541e79c9ba1a087f84cc4b49d420c59d8257960616e8bbe
-
SSDEEP
24576:pRGTwxXlaZ/pZLxIu7IT2Bv+ZcL45/oVPRsms2Jm:/GsxoJxIu7IT2ZTb1Rtsem
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 1236 95b5a931740d780c4af7bb33b0a33b2a.exe 1236 95b5a931740d780c4af7bb33b0a33b2a.exe 1236 95b5a931740d780c4af7bb33b0a33b2a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 95b5a931740d780c4af7bb33b0a33b2a.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main 95b5a931740d780c4af7bb33b0a33b2a.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 95b5a931740d780c4af7bb33b0a33b2a.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1236 95b5a931740d780c4af7bb33b0a33b2a.exe 1236 95b5a931740d780c4af7bb33b0a33b2a.exe 1236 95b5a931740d780c4af7bb33b0a33b2a.exe 1236 95b5a931740d780c4af7bb33b0a33b2a.exe 1236 95b5a931740d780c4af7bb33b0a33b2a.exe 1236 95b5a931740d780c4af7bb33b0a33b2a.exe 1236 95b5a931740d780c4af7bb33b0a33b2a.exe 1236 95b5a931740d780c4af7bb33b0a33b2a.exe 1236 95b5a931740d780c4af7bb33b0a33b2a.exe 1236 95b5a931740d780c4af7bb33b0a33b2a.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD5bb95f50bb5f2144bd8fa57e3dfc038ad
SHA162f55ca2eddb1978270010f3788427f6b3dc107c
SHA256a6aed940c07783d91b78568901d79b108d0d13a6a92eab081fffdda798784972
SHA51275ae009d1f9b9f24df17529c87d425850ba1750fe6d0d93aa619fba5b4ca89ab5c13927741e4df827fd3d47cb2a3fce08972c531468aa89bcb1bffe3fc2e51d5
-
Filesize
144KB
MD5f8707fc7275dbd973e9a7f72682450de
SHA154f00c9fb0827a69b133757fd67a474a1b35e31a
SHA256a154fa991b1b8c202ae19a02f8a5f5b57745e9c6d7061908973e2da7f069625a
SHA5122ed18f1dfaf898acbb8c78476a72a9403b67b25b05f588378a5979bb1e546829842f17a6abdd35d6b22c7a62c61a6e285ccc3aad31e7a8ba1607b879cf1c42c2
-
Filesize
1.1MB
MD5c99826e5901ad146870b4ea8c74c6979
SHA10bcb1393ecfacefb8ee3b6199526d9bbc51364c5
SHA25603aff11e16d3346689e977733c0539a17a00a97ca29b1f38e54c6adc4fb5cd21
SHA512b3f8991bd95c72837a8c39099cf4a142a1b546d247b1d53edc40943b9c9e98e0fea4c6730468a38c33fea54061244e6a9101c35416b7a8e3741166c81440622b