68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Size

1.1MB
MD5

29e583ce23b9dd282681fb073c7ed912
SHA1

1b5d3af3002325b9b9696c18f8b05447aa05712f
SHA256

68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db
SHA512

d22e9432373fc9c359c4e45522c7f5d6d49d0032a7f49d548ea82c1517b7663fb4c5c3e4b882e18c1fbc9c6f87569ec5c06d8dcf62e187d7865793dd37c64558
SSDEEP

12288:/KdeYqxG3V1jMn4D752IGc73iDZdIn5nXWPx4Rf6Ivy7Kpgvju2Dk6OFB/rC:/R4k4D75263i6Sx4RfPvy7Egq2DSB

Score

1^/10

Malware Config

Signatures

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Datalog.Document\shell\open	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Datalog.Document\shell\print\command	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Datalog.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\68F953~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\""	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.avdata\ShellNew	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Datalog.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\68F953~1.EXE,0"	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Datalog.Document\shell	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Datalog.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\68F953~1.EXE /p \"%1\""	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Datalog.Document\shell\printto\command	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.avdata\ShellNew\NullFile	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Datalog.Document	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Datalog.Document\ = "Datalogger Document"	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Datalog.Document\DefaultIcon	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Datalog.Document\shell\printto	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.avdata\ = "Datalog.Document"	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Datalog.Document\shell\open\command	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Datalog.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\68F953~1.EXE \"%1\""	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Datalog.Document\shell\print	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.avdata	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2888	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
2888	68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe

C:\Users\Admin\AppData\Local\Temp\68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe
"C:\Users\Admin\AppData\Local\Temp\68f953f962964532f421c386014153b43796ec53aa3a876e31fff565271431db.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2888

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads