Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 00:34
Static task
static1
Behavioral task
behavioral1
Sample
95c856de89b379d51f806a900bfce218.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
95c856de89b379d51f806a900bfce218.exe
Resource
win10v2004-20231215-en
General
-
Target
95c856de89b379d51f806a900bfce218.exe
-
Size
78KB
-
MD5
95c856de89b379d51f806a900bfce218
-
SHA1
6c53d5c020477e549fc4785e8306c866951c4b28
-
SHA256
892ba56e251143a21c51e71cb3a2e8e8b3b29fdf6f549cd1e59f6f64fd99f114
-
SHA512
75c8b634d562e49ab2203882599a34d8967971004e435cc3be1767062951b5baa5ac1f2260f043cd6e819e3d5e351c88042a9fddfc6e5782c2aa05ffdfba7205
-
SSDEEP
1536:yx2b5cts0NiyqAKgjqvJ1J1N9fDRr6gVoRUm4ZtHDCcq4XxskNU42:ygb6l2AZq1Jz9tr6sEUgc6A
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1988 95c856de89b379d51f806a900bfce218.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\7F1C46C1BD7F.dll 95c856de89b379d51f806a900bfce218.exe File opened for modification C:\Windows\SysWOW64\7F1C46C1BD7F.dll 95c856de89b379d51f806a900bfce218.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{727E6F1E-2CBA-4706-83E5-56EE89AFB945}\InProcServer32\ = "C:\\Windows\\SysWow64\\7F1C46C1BD7F.dll" 95c856de89b379d51f806a900bfce218.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{727E6F1E-2CBA-4706-83E5-56EE89AFB945}\InProcServer32\ThrEaDiNgModEL = "aPaRTmEnT" 95c856de89b379d51f806a900bfce218.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{727E6F1E-2CBA-4706-83E5-56EE89AFB945} 95c856de89b379d51f806a900bfce218.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{727E6F1E-2CBA-4706-83E5-56EE89AFB945}\ = "DIDI" 95c856de89b379d51f806a900bfce218.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{727E6F1E-2CBA-4706-83E5-56EE89AFB945}\InProcServer32 95c856de89b379d51f806a900bfce218.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1988 95c856de89b379d51f806a900bfce218.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD50a256a3f235c7fc6139faf5fad95354a
SHA1d4dcf59de924967017451be587204c9e323907a9
SHA256cda36ce52206775fc42defdf8c2f72f3fa412610478560f6937efc48797f7dfc
SHA5122bc89c2d643bc68b389789c3322d817c665db4db779a16016b904a882a0c80d4d861f85306e7e384aaca2d3449a71cb51ecfec856aa42507671cd7dddd1ad7cf