e5c5cbba198f1b901a369970c153851d08ff5e5b73685b8d04636d3f339e3c1c

Analysis

max time kernel
141s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 13:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b78ef16f38f625591bfc6684cb4ac871.exe
Size 287KB
Sample240306-q59avsdd52
SHA256 e5c5cbba198f1b901a369970c153851d08ff5e5b73685b8d04636d3f339e3c1c
MD5 b78ef16f38f625591bfc6684cb4ac871
SHA1 3c26a41a661241644608aa9131864aaf4735ecdd
SHA512 5cacbbf65f8a270701c401cd9b50e5d2e065c72fd8a6f2100c2f531eca4342d3355b5e535063769395ffcbb5609f1dd07a5a46b149ce5c2883c0e6249c91e898
SSDEEP 6144:zDjGRdk0zOYAFvi48tViDv9PiBCLOyNyB/1Ob/VLCvehA:zDjwFOYAF6VTiJPiBCLOyNyfObdvA
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\LocalServer32	b78ef16f38f625591bfc6684cb4ac871.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\b78ef16f38f625591bfc6684cb4ac871.eBookNSHandler	b78ef16f38f625591bfc6684cb4ac871.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\b78ef16f38f625591bfc6684cb4ac871.eBookNSHandler\ = "eBookNSHandler"	b78ef16f38f625591bfc6684cb4ac871.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\b78ef16f38f625591bfc6684cb4ac871.eBookNSHandler\Clsid	b78ef16f38f625591bfc6684cb4ac871.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}	b78ef16f38f625591bfc6684cb4ac871.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\ = "eBookNSHandler"	b78ef16f38f625591bfc6684cb4ac871.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b78ef16f38f625591bfc6684cb4ac871.exe"	b78ef16f38f625591bfc6684cb4ac871.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\b78ef16f38f625591bfc6684cb4ac871.eBookNSHandler\Clsid\ = "{9C453F21-396D-11D5-9734-70E252C10127}"	b78ef16f38f625591bfc6684cb4ac871.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\ProgID	b78ef16f38f625591bfc6684cb4ac871.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9C453F21-396D-11D5-9734-70E252C10127}\ProgID\ = "b78ef16f38f625591bfc6684cb4ac871.eBookNSHandler"	b78ef16f38f625591bfc6684cb4ac871.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2060	b78ef16f38f625591bfc6684cb4ac871.exe
2060	b78ef16f38f625591bfc6684cb4ac871.exe

C:\Users\Admin\AppData\Local\Temp\b78ef16f38f625591bfc6684cb4ac871.exe
"C:\Users\Admin\AppData\Local\Temp\b78ef16f38f625591bfc6684cb4ac871.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2060-0-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/2060-1-0x0000000000400000-0x000000000049F000-memory.dmp

Download

memory/2060-3-0x0000000002230000-0x0000000002231000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads