Analysis
- max time kernel
110s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
08/04/2024, 09:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Internet Download Manager 6.42 Build 7 Multilingual Retail/Crack/Patch.exe
Resource
win7-20240220-en
5 signatures
120 seconds
Behavioral task
behavioral2
Sample
Internet Download Manager 6.42 Build 7 Multilingual Retail/Crack/Patch.exe
Resource
win10v2004-20240226-en
5 signatures
120 seconds
Behavioral task
behavioral3
Sample
Internet Download Manager 6.42 Build 7 Multilingual Retail/idman642build7f_Downloadly.ir.exe
Resource
win7-20240319-en
4 signatures
120 seconds
Behavioral task
behavioral4
Sample
Internet Download Manager 6.42 Build 7 Multilingual Retail/idman642build7f_Downloadly.ir.exe
Resource
win10v2004-20240226-en
27 signatures
120 seconds
General
- Target Internet Download Manager 6.42 Build 7 Multilingual Retail/Crack/Patch.exe
- Size 43KB
- Sample240408-k7l1fsdf85
- SHA256 05305d00c781f8924e6077131b47e87fa74ff88345983fefb318547b7c1553ba
- MD5 faa1605368ba9ec8485ff00673fb364b
- SHA1 129ac7991b109627ba6683369e64975a14480bf2
- SHA512 18da3f607a8704b20fca7ccad851db5b3d640f73c09ffe39bd2f3d75aa8254e59f792ccfb5b76426bb2930198dfd2b24eb214b218e463568109456ef7061cc5a
- SSDEEP 768:E4lmeEPt7I62f99KsYBxNDf9z/c36/nIU9h0rDpcCpzFub3Z:3lmFJqfKsYnF17cKNh0r1cTbJ
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "0" Patch.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0" Patch.exe - Disables Task Manager via registry modification
- Disables cmd.exe use via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0" Patch.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4848 Patch.exe 4848 Patch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Internet Download Manager 6.42 Build 7 Multilingual Retail\Crack\Patch.exe"C:\Users\Admin\AppData\Local\Temp\Internet Download Manager 6.42 Build 7 Multilingual Retail\Crack\Patch.exe"1⤵
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Suspicious behavior: EnumeratesProcesses
PID:4848