dd2cf12c398ad5d11c4ceb5c4f73e8c947a68a24d4d6a2c4888d988d3142034d

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Size

14.7MB
MD5

95ffb8a9ffaf6a24726d98b5deb7ce99
SHA1

d7ef0ee6e1e77d4b9ca89b64806fc918bb08585a
SHA256

dd2cf12c398ad5d11c4ceb5c4f73e8c947a68a24d4d6a2c4888d988d3142034d
SHA512

5c78680341e2676ef290f63506dde8a446155defad7c57ca0281b140ab9c1660863982c44263845349fe6d0238dbfcea13576ca9588842a230c7389f65aad322
SSDEEP

393216:lVa4p9DdHIThe89oCOhA87K2LnNOmWBNEHy:lHtoTqVhA8fDNOmQn

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2392-0-0x0000000000400000-0x00000000004E0000-memory.dmp	upx
behavioral2/memory/2392-2-0x0000000000400000-0x00000000004E0000-memory.dmp	upx

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\ProgID	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\LocalServer32	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\95ffb8a9ffaf6a24726d98b5deb7ce99.eBookNSHandler\Clsid	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\LocalServer32	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\95ffb8a9ffaf6a24726d98b5deb7ce99.ExternalNSHandler	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\95ffb8a9ffaf6a24726d98b5deb7ce99.ExternalNSHandler\ = "ExternalNSHandler"	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\95ffb8a9ffaf6a24726d98b5deb7ce99.ExternalNSHandler\Clsid	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\ProgID\ = "95ffb8a9ffaf6a24726d98b5deb7ce99.eBookNSHandler"	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\ProgID	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\ = "ExternalNSHandler"	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\ = "eBookNSHandler"	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\95ffb8a9ffaf6a24726d98b5deb7ce99.eBookNSHandler	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\95ffb8a9ffaf6a24726d98b5deb7ce99.eBookNSHandler\ = "eBookNSHandler"	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\95ffb8a9ffaf6a24726d98b5deb7ce99.eBookNSHandler\Clsid\ = "{9C453F21-396D-11D5-9734-70E252C10127}"	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\95ffb8a9ffaf6a24726d98b5deb7ce99.exe"	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\95ffb8a9ffaf6a24726d98b5deb7ce99.ExternalNSHandler\Clsid\ = "{D173E10A-001D-4318-9822-8C97A8418482}"	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D173E10A-001D-4318-9822-8C97A8418482}\ProgID\ = "95ffb8a9ffaf6a24726d98b5deb7ce99.ExternalNSHandler"	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\95ffb8a9ffaf6a24726d98b5deb7ce99.exe"	95ffb8a9ffaf6a24726d98b5deb7ce99.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2392	95ffb8a9ffaf6a24726d98b5deb7ce99.exe
2392	95ffb8a9ffaf6a24726d98b5deb7ce99.exe

C:\Users\Admin\AppData\Local\Temp\95ffb8a9ffaf6a24726d98b5deb7ce99.exe
"C:\Users\Admin\AppData\Local\Temp\95ffb8a9ffaf6a24726d98b5deb7ce99.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2392-0-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2392-1-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/2392-2-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2392-4-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads