1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e

Analysis

max time kernel
144s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe
Size

1.4MB
MD5

65665e881febd6bdaeada727cf2414da
SHA1

3d43eb47e4382aef7d95ab9c2ab0e48ec5cd45e0
SHA256

1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e
SHA512

4e099bff8a7322d3165306821f7370e3ebe49c7cbf53e1da75a170a00bb392dcbda3583802c6ad41b1e9914402cdd92b0b868188aca85cfb07cc302dba5d40b5
SSDEEP

24576:CE7ApBVtuQbtUgO+IT1lzFeE6f6y5ipNv07El5E5eT16lqoQ2JR:CE7ApBYPdoy+8ueTQlqoQ2J

Score

1^/10

Malware Config

Signatures

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\WOW6432Node\CLSID\{ACBF78C8-3876-406d-8067-B7E97AA29B01}	1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist\ = "Playlist"	1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe,1"	1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe
Key created	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist\shell\open\command	1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe
Key created	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist\shell	1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe
Key created	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\.playlist	1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\.playlist\ = "AnyVideoSoftware.AnyVideoPlayer.playlist"	1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe
Key created	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist	1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe
Key created	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist\DefaultIcon	1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe
Key created	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist\shell\open	1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\AnyVideoSoftware.AnyVideoPlayer.playlist\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe\" \"%1\""	1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000_Classes\WOW6432Node\CLSID\{ACBF78C8-3876-406d-8067-B7E97AA29B01}\ = 9d89bbb29cbf91ad9db08daa9db095afce86ccb29d8699b299af94cace86cbca998688ce98bf91ae99869d9f9d9598cb9d86becf99bf91b3ce86cbca9d9595ab9bcd98cf9db08d9f9c968ccf9b968ccc9cbf91ae9c89bbd1ce86a79f9d96c8b29bcd88cf9dbfc89f	1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1284	1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe
1284	1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe
1284	1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe

C:\Users\Admin\AppData\Local\Temp\1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe
"C:\Users\Admin\AppData\Local\Temp\1c698c2d472b7d33e870c30e321f1fe4131d1a9c1e9773f11aea735c5d39273e.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1284

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads