Analysis
-
max time kernel
2s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/06/2024, 10:13
Static task
static1
Behavioral task
behavioral1
Sample
av8ErYlLcOYm.exe
Resource
win11-20240611-en
General
-
Target
av8ErYlLcOYm.exe
-
Size
1.4MB
-
MD5
025c9c1d81a59636b571bdeb5771e88b
-
SHA1
1699b594612cb29084c10117dc17762ee94c2f78
-
SHA256
d16f4df6d0a0b0993748bd01ffd6f4ef8bdf1a57399f4310583986b9fbf0be40
-
SHA512
06fda7f365306f717cf328d56f4be0c8ee5f3752dc09d2d2dcaabdf225bed13e7a02478543aedb01cec47ea39d8d59a85939515066dadc37e951ec3c95c93139
-
SSDEEP
24576:iJgvkMzSYAM9YSlbczEpQizftQDc06WogeOfQr0W:itMzLAVStcdiTgFoR2A0W
Malware Config
Signatures
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3292 MiniSearchHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\av8ErYlLcOYm.exe"C:\Users\Admin\AppData\Local\Temp\av8ErYlLcOYm.exe"1⤵PID:4664
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3292
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD5e0236413295e49948baeeb46d884acef
SHA1c24f80184264ef596722c1a84b8dedde9bdad557
SHA25611af5d1895a6e5952ebf08f72ad5121d828a5e2f8dc0656875d527e886ca54e8
SHA512d99fd945c37dee141ea4e4f2e2460f482230bb679d8a63131348685a7dbebce074c9543161672fc525cd0c84d41d29e2ee78f6e3a7b8f7d18ca40eefcb95e5c6