7abe1c909e871079beb4d1e20480157b4ebfeea21cdce70ddbc963f09a240824

Analysis

max time kernel
141s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 00:28

Target
7abe1c909e871079beb4d1e20480157b4ebfeea21cdce70ddbc963f09a240824.exe
Size 4.8MB
Sample240614-asmy4axepe
SHA256 7abe1c909e871079beb4d1e20480157b4ebfeea21cdce70ddbc963f09a240824
MD5 6a4687f2bada022571bcd4f5d5437319
SHA1 252d6c1f1e50842e25f413ac0f425f0932519675
SHA512 d00d210a15f2c2bb96405b773d0945f150d046c0460ecd1ed5be87c25cf2a2fb2ae137f0c5c13fbd773fcf66936cd5dbc22186460ba6c73a671c1930b9537dc0
SSDEEP 98304:DgtXQjGF+9kgXsr5y1WXIsA38rYRw9JBy5s7G4SbKHz9w5m:qKGs9kUe6j3CYAByeQb0uc
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/3152-0-0x0000000000400000-0x00000000006B3000-memory.dmp	UPX
behavioral2/memory/3152-8-0x0000000000400000-0x00000000006B3000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3152-0-0x0000000000400000-0x00000000006B3000-memory.dmp	upx
behavioral2/memory/3152-8-0x0000000000400000-0x00000000006B3000-memory.dmp	upx

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C546A127-E1AA-4c8d-A5E2-0445D3C51623}\Implemented Categories\{635EA865-001C-462c-A7AE-8EED850706F8}	7abe1c909e871079beb4d1e20480157b4ebfeea21cdce70ddbc963f09a240824.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	7abe1c909e871079beb4d1e20480157b4ebfeea21cdce70ddbc963f09a240824.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	7abe1c909e871079beb4d1e20480157b4ebfeea21cdce70ddbc963f09a240824.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C546A127-E1AA-4c8d-A5E2-0445D3C51623}	7abe1c909e871079beb4d1e20480157b4ebfeea21cdce70ddbc963f09a240824.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C546A127-E1AA-4c8d-A5E2-0445D3C51623}\Implemented Categories	7abe1c909e871079beb4d1e20480157b4ebfeea21cdce70ddbc963f09a240824.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C546A127-E1AA-4c8d-A5E2-0445D3C51623}\Implemented Categories\{635EA865-001C-462c-A7AE-8EED850706F8}\uuid = "2bb7cb8e4f7a623a0a2cad449bd39a1d"	7abe1c909e871079beb4d1e20480157b4ebfeea21cdce70ddbc963f09a240824.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3152	7abe1c909e871079beb4d1e20480157b4ebfeea21cdce70ddbc963f09a240824.exe
3152	7abe1c909e871079beb4d1e20480157b4ebfeea21cdce70ddbc963f09a240824.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4968

installConfig.xml

Path C:\Users\Admin\AppData\Local\Temp\~e57fb67\installConfig.xml
Size 6KB
SHA256 dfd7f63faf916f7403a00472fa94211c7653c7f101f163faddef021f918d0fde
MD5 cab4bfebcf16e1a9b59d77aa6b798231
SHA1 8657b2733f8d3e8215c21bebbf875eb244f3d5f8
SHA512 f07f6414169f86c14377d5fd06cef6419e1d83e7dcb551d2a2d71e5adca5e537064ba3e000517d2c97c04e2571a253b4c750f773483aa7954a2c56b86146fc00
SSDEEP 96:rrUUBHqumouCyDyXm/izN9sX4ihAc7qpUyvL4F/c/3eczcYjcYPT3eBW3C:rrU7e2/GN9sIU7qpUEBZtPT3FC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3152-0-0x0000000000400000-0x00000000006B3000-memory.dmp

Download

memory/3152-6-0x0000000002640000-0x0000000002641000-memory.dmp

Download

memory/3152-8-0x0000000000400000-0x00000000006B3000-memory.dmp

Download