Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 01:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e36831314d6811fa7a16d94304a0ccb89f34eb9fc8e1afcc359a2c94b4291d5b.exe
Resource
win7-20240221-en
3 signatures
150 seconds
General
-
Target
e36831314d6811fa7a16d94304a0ccb89f34eb9fc8e1afcc359a2c94b4291d5b.exe
-
Size
2.0MB
-
MD5
73a179e43a278e016e089e71f0bf10bf
-
SHA1
ff0e30dd7651be8b047e8b10110f148284d3fb30
-
SHA256
e36831314d6811fa7a16d94304a0ccb89f34eb9fc8e1afcc359a2c94b4291d5b
-
SHA512
b612714941498a978ca269695541f46b0f73e2d1f803a08cd9ce41bdbabaf6171a094536a64b79f38543a196c759b5566265774a3ad6b985f3d3d9a12a505b05
-
SSDEEP
24576:e6Rcpupkgw45/PtwvFAsapDASpjBAJhEQ0oTbIwTYs42cYbDyGWBVGZu8BlscURP:eHvY/PbsapcLZ0g6hAyGWv4uAD
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" e36831314d6811fa7a16d94304a0ccb89f34eb9fc8e1afcc359a2c94b4291d5b.exe -
resource yara_rule behavioral2/memory/3576-0-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-9-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-5-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-35-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-43-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-39-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-37-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-34-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-31-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-29-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-27-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-25-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-23-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-21-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-19-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-17-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-15-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-13-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-11-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-8-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-41-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-3-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-2-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-1-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3576-50-0x0000000010000000-0x000000001003F000-memory.dmp upx -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3576 e36831314d6811fa7a16d94304a0ccb89f34eb9fc8e1afcc359a2c94b4291d5b.exe 3576 e36831314d6811fa7a16d94304a0ccb89f34eb9fc8e1afcc359a2c94b4291d5b.exe 3576 e36831314d6811fa7a16d94304a0ccb89f34eb9fc8e1afcc359a2c94b4291d5b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e36831314d6811fa7a16d94304a0ccb89f34eb9fc8e1afcc359a2c94b4291d5b.exe"C:\Users\Admin\AppData\Local\Temp\e36831314d6811fa7a16d94304a0ccb89f34eb9fc8e1afcc359a2c94b4291d5b.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Suspicious use of SetWindowsHookEx
PID:3576