b00d563bc49598901acc89e49241e796b2a5b2ec9fa0f525c45d82eaf4d79372 | Triage

Resubmissions

22-05-2024 20:36

240522-zdtwjaff5z 8

22-05-2024 20:35

240522-zc4pcaff2x 3

22-05-2024 20:32

240522-zbjb1sfe4y 3

Analysis

max time kernel
30s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
22-05-2024 20:35

Sharing

Report Analysis Logs

General

Target

Anim8or.exe
Size

3.7MB
MD5

ee423a7e602351be05b555ade5e47f81
SHA1

7e4cb7836e2a7f3a1f3af01616d50240ca0c08ea
SHA256

b00d563bc49598901acc89e49241e796b2a5b2ec9fa0f525c45d82eaf4d79372
SHA512

1a26066726590a2823f3d4081bc6266b07acbc1f3a61fea201f118475b9b7df8fa42d5f475570ee01e90bc0e7e5c55f3df8a9e163bd0fabfd89b7d408aef2906
SSDEEP

98304:IJzT62dhgOGUYaNkpG7F61uPVrxSL8Gk:QX/rjNkpGB63L8V

Score

1^/10

Malware Config

Signatures

Modifies registry class 8 IoCs

Processes:

Anim8or.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\an8file	Anim8or.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\an8file\ = "Anim8or file"	Anim8or.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\an8file\shell\open\command	Anim8or.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\an8file\shell	Anim8or.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\an8file\shell\open	Anim8or.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\an8file\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Anim8or.exe \"%1\""	Anim8or.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\.an8	Anim8or.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\.an8\ = "an8file"	Anim8or.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Anim8or.exe

pid process

1280 Anim8or.exe

C:\Users\Admin\AppData\Local\Temp\Anim8or.exe
"C:\Users\Admin\AppData\Local\Temp\Anim8or.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1280

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...