5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324

Analysis

max time kernel
1648s
max time network
1548s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 20:51

Target

bvpn.exe
Size

1.1MB
MD5

c5e8208089ad21661674499dc1fd924a
SHA1

cdab2916aadf6def06681e140f721891586736d0
SHA256

9f041b16425b2af8912cf13a2201b9db285e63d8c37401a8f9164d25a47b70c4
SHA512

4e3a18812a0adf109018022d5913f9eb58f4758585a8da0e102926219531361f478c117a6150198bb7d543ccf2411d5bf7fa2de5018bf5d79be55feaeda4bdf0
SSDEEP

12288:InYDLKcvZOinl6THSb75GAOj9rZfOU5A/+Nv+f3lp9liAPxgVNp:InYDLKcxO9ybcjNgU5AWQfH9QGgVNp

Score

1^/10

Modifies registry class 1 IoCs

Processes:

bvpn.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WF_SERVICE_NPV_FF56A4C7	bvpn.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

bvpn.exe

pid	Process
2508	bvpn.exe
2508	bvpn.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

bvpn.exe

pid	Process
2508	bvpn.exe
2508	bvpn.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

bvpn.exe

pid	Process
2508	bvpn.exe
2508	bvpn.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

bvpn.exe

memory/2508-0-0x0000000002C50000-0x0000000002D75000-memory.dmp

Filesize
1.1MB

Download