4998d71470d6072505f9c896802000e6e0894cf0d8ef43e58e30cb31bc60a695

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 02:22

Target

SecuriteInfo.com.Adware.Presenoker.25193.8700.exe
Size

765KB
MD5

9532cdd0f2aaa6d929eaffa547735ac1
SHA1

e916bbbec7b7dea552c0e5e9a03760c7f0fa331f
SHA256

4998d71470d6072505f9c896802000e6e0894cf0d8ef43e58e30cb31bc60a695
SHA512

afa1e6ef8d41beb13ce6fec185c7c3328d2c662eeb12eeb46feb31e73dae659261ab4e8c191fd2af8063d3f89fdbde4c62949e3f624a21428cc1b26944e1251a
SSDEEP

12288:fG1DRleeWLpx5RBQbaAYYEJTrxmUmau2emeh9QjetnTITx1Q+DgDnrsaS57bEGUZ:fYDGpx5RWaAYHTrxmUma6Fq6xQ1xZWpf

Score

1^/10

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2384	SecuriteInfo.com.Adware.Presenoker.25193.8700.exe
2384	SecuriteInfo.com.Adware.Presenoker.25193.8700.exe
2384	SecuriteInfo.com.Adware.Presenoker.25193.8700.exe
2384	SecuriteInfo.com.Adware.Presenoker.25193.8700.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.Presenoker.25193.8700.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Adware.Presenoker.25193.8700.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2384

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x40c
1⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:3684