9c113ec7caa9fabb41d04f0013e1ff0214bb5d3b06f4bfb3eea8dab01b1f74ee

Analysis

max time kernel
141s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a981481a4a82bdeaa7039912cfec1c5b.exe
Size

799KB
MD5

a981481a4a82bdeaa7039912cfec1c5b
SHA1

4097d669b2eb7c79a90d8780e98a3edf25505876
SHA256

9c113ec7caa9fabb41d04f0013e1ff0214bb5d3b06f4bfb3eea8dab01b1f74ee
SHA512

1d6cb4f548ad07cd05ae0aee6673042cca816f090bec08dfd95cd58e7204d515f82a05bbf81693c1ff06680d5437133c9d59d735f53e1d5c25fe1f7a1f214b97
SSDEEP

24576:kSMAyrJY6lcsYqMgA1PFCuEZyoX0ssz2Qq:kSMLJy

Score

1^/10

Malware Config

Signatures

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51D12DE6-B5D9-4EE0-9C23-9BCE0E7F6DC3}	a981481a4a82bdeaa7039912cfec1c5b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51D12DE6-B5D9-4EE0-9C23-9BCE0E7F6DC3}\Info\Data = 005f0043000200000273007300fc4108b55c004300040000044900440004000004350031004400310032004400450036002d0042003500440000000000340045001000000016beffff0000000033002d003900420043004500300045003700460000007100000000007d005c0012000000940271000000000080000000000000000000000000000000e80272000000000000000000000000000e0000000100000000000000000000001200000012000000dc0271000100000068b47200030000007f000000000000000000000012000000580c720000000000f00272000000000000000101a8fb7100c000710012000012120000000cfa567b0000190000fa190048000000700271001200000070027100f0f901011200000012000000feffffff00fa190060fa190040adbf7798c2000cfeffffffccf919001d79c077000000004479c077f002720000007100000000000000000064006400f0027200c8fa19000000000028fa1900f0027200640064000000000040ea74000200000000000000f0027200f00272000000710062000000e8f91900163cbc770000000000000000000000000000008028fa1900fcf91900a8baba772ce44900d0fa1900000000000cfa190040ea7400000000000000000094fa1900f54e8976d0fa190094fa1900b14f897640fa1900ca8681c92ce4490040f73102dcbf310220c13102000000001cc13102000000000000000040ea740002000000000000000000000000000000fe294000b0fa1900000000001cc13102000000000000000040f731020600000024fa1900d8fa1900d8fa190070078c7686230dbffeffffffccfa1900e304342e303000002ce44900db4effff0000000000000000f07843000000000000000000a426310224000000	a981481a4a82bdeaa7039912cfec1c5b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51D12DE6-B5D9-4EE0-9C23-9BCE0E7F6DC3}\Info\Data = 001d775877f41e4800020000003054587728000000d00702006400000048fc1900280000000300000098af710088a1720000000000000000004479c077e8a37200000071008000008000000200cc010200000000001a000000fc080200640000000000000000af71000e000000000000001f000e0088a17200e8a3720098af710000007100271c5777b4fb1900163cbc770000000000000000000000009a010600000000800000000070fc1900d01c57770000710000000000e8a372000c31420080000000721300000000000030fc19000000000000040000000000000000000000000000000000000000000000000000000000000000000001000080cc31420000000000940f6f0000000000ecfc19006fa657776ca4577744af14f63313000000000000180000001a000000e8a300000000000030fc190001000000000000000000000000000000ffffffff070000004479c07748eb7400000071000700000024000000b0fc190018aa5677cc3142000c2abf77d61f587790fc1900180000000000000000000000000000000000000000000000000000000000000000fd19009d4ebf77c4fc19000800000060fd1900d04dbf77d0fc1900120f6f0000000000bc15a47686aa57779a010600fcffffff120f6f0001000000b82631027cc031029a010600017241009a01060050fd19000000000010fd190095a55677120f6f00f0fe3102702731021cc131020c564a00d4040000141000006e274000b8fd1900972740009e274000b82631029827310298273102702731020000000094fd1900b32a4000b82631020546400090fd19004823480050234800b8fd19008904342e30304900dcbf3102db4effff0000000054d549002400000000000000000000000000000000000000	a981481a4a82bdeaa7039912cfec1c5b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51D12DE6-B5D9-4EE0-9C23-9BCE0E7F6DC3}\Info	a981481a4a82bdeaa7039912cfec1c5b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	a981481a4a82bdeaa7039912cfec1c5b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	a981481a4a82bdeaa7039912cfec1c5b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3184	a981481a4a82bdeaa7039912cfec1c5b.exe

C:\Users\Admin\AppData\Local\Temp\a981481a4a82bdeaa7039912cfec1c5b.exe
"C:\Users\Admin\AppData\Local\Temp\a981481a4a82bdeaa7039912cfec1c5b.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tr3.ini

Filesize
6KB

MD5
bd06f96950717a91b6c0eb0ba10ec1ce

SHA1
d16ae13f51200068f57d4a829881ce9222c1e2db

SHA256
8cac35da75606d2bde6286f1f4a598ec017b27e25e3c7c233e2ebab8fc89a28f

SHA512
4751fb9c3a362e54b4682126de0183454dad3b07bb590502f0ee444db2aa49112778f5bc02fe36a3c5e5dd21b61788063af61fedfcfe954ca434670c1f50fc36

Download Submit
memory/3184-0-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/3184-363-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3184-365-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads