165fb59360683122125271d668cfb28c3ad9502d559e491856005178fb22a254

Resubmissions

29-04-2024 17:56

17-04-2024 14:59

16-04-2024 14:20

max time kernel
301s
max time network
1611s
platform
windows10-1703_x64
resource
win10-20240404-de
resource tags

arch:x64arch:x86image:win10-20240404-delocale:de-deos:windows10-1703-x64systemwindows
submitted
16-04-2024 14:20

Target

The-MALWARE-Repo-master/Email-Worm/Bugsoft.exe
Size

32KB
MD5

70f549ae7fafc425a4c5447293f04fdb
SHA1

af4b0ed0e0212aced62d40b24ad6861dbfd67b61
SHA256

96425ae53a5517b9f47e30f6b41fdc883831039e1faba02fe28b2d5f3efcdc29
SHA512

3f83e9e6d5bc080fb5c797617078aff9bc66efcd2ffac091a97255911c64995a2d83b5e93296f7a57ff3713d92952b30a06fc38cd574c5fe58f008593040b7f0
SSDEEP

384:/TELevJlARz3z1AWoYbEz3QqRbViB3CoUEmeQo/o2Y0gsjDWK7L:/gLevJlARz3z1AWoYbEz3Ngk6WK7L

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\jk.bat	Bugsoft.exe
File created	\??\c:\windows\mail.vbs	Bugsoft.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5092	Bugsoft.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 2964	5092	Bugsoft.exe	73
PID 5092 wrote to memory of 2964	5092	Bugsoft.exe	73
PID 5092 wrote to memory of 2964	5092	Bugsoft.exe	73

C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Bugsoft.exe
"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Bugsoft.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\jk.bat
  2⤵
  PID:2964

\??\c:\windows\jk.bat

Filesize
3KB

MD5
a725af7c07b52549023be73328e55809

SHA1
c9d8072aaac80f6cf1edfaeaba6c934196631c81

SHA256
e009a52eeb2138531c799905010f7677b0fdd4190abe4ac0a25e0e15eb30d865

SHA512
d4cd904da5c6a5c6112d212b218abc76429da0e4d6382f4fbd9ca51a976eedef26e202607ff6041c4de7e9db783f62e5a24ee560fed068945aef69fa5491a3ce

Download Submit