Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-04-2024 22:08
Behavioral task
behavioral1
Sample
a7eddf587e0a51d85e1c030f66d184848c3533d21b944481ecba6750f880b5df.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a7eddf587e0a51d85e1c030f66d184848c3533d21b944481ecba6750f880b5df.exe
Resource
win10v2004-20240226-en
General
-
Target
a7eddf587e0a51d85e1c030f66d184848c3533d21b944481ecba6750f880b5df.exe
-
Size
2.6MB
-
MD5
8fce71c4f7062a28194ad2e45ce47ee5
-
SHA1
e219e63ce82ccd65612820d5aaa99ab246b97991
-
SHA256
a7eddf587e0a51d85e1c030f66d184848c3533d21b944481ecba6750f880b5df
-
SHA512
a0c0c820e46989ebdfb9093d9483089332f52c8d7e5b376092f47eaa851e01cc5e34b20889a0b17d35cae371a211100581b311fe377aa46d120bbd7b2589bd15
-
SSDEEP
49152:sVm+Lki/gZIENotI0dd/7pwKWDBU0iZRl1sc/cCK20NAjCS/6ezcQjQg:sLLkOO7sISdwpSRlyYcRzW6Gc7
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2956-0-0x0000000000400000-0x0000000000AE1000-memory.dmp upx behavioral1/memory/2956-11-0x0000000000400000-0x0000000000AE1000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2956 a7eddf587e0a51d85e1c030f66d184848c3533d21b944481ecba6750f880b5df.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2956 a7eddf587e0a51d85e1c030f66d184848c3533d21b944481ecba6750f880b5df.exe 2956 a7eddf587e0a51d85e1c030f66d184848c3533d21b944481ecba6750f880b5df.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7eddf587e0a51d85e1c030f66d184848c3533d21b944481ecba6750f880b5df.exe"C:\Users\Admin\AppData\Local\Temp\a7eddf587e0a51d85e1c030f66d184848c3533d21b944481ecba6750f880b5df.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2956
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\BL5WH5X1.htm
Filesize397KB
MD55d1239987c5352da0fefe6275ea06c02
SHA154f6447c90334fd4d5abc4246cc2fea124c95fd7
SHA25672efaca9cd62977c9d6802d39aeacc129a16d2012c1c71f36c403d4d386876ec
SHA512e985929b1c56ea5b475582c72970536437a80a43d23d180375c47fdef2b76d7cd693414853f5d9765033e80cc4fe8c83b9c95a11f36087fdbd55a396a5775508