Analysis
-
max time kernel
290s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 23:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe
Resource
win7-20240508-en
2 signatures
300 seconds
General
-
Target
b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe
-
Size
1.3MB
-
MD5
5de967b32ccd8caca224321d973c76fb
-
SHA1
f29e3ecb37ff244f0a80f50333ef937969afeaa1
-
SHA256
b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72
-
SHA512
39bd08ef14be8d6cf8c3f1345c3191e9fe4c74369f3c59efc8f5c27edad15f9e14470ce83f103394a2100ba1b07e25629bda02047da13b443ab0c669bc9ad2e8
-
SSDEEP
24576:9rt+zllz7+QDSfCpUugcVN1Hli3nqEjQiDcjPdrqwQ+gsiK3H2xgkHOW1:927z7+1fCpjgcpM6EjQiDcjpqli3Wxg2
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 29 IoCs
pid Process 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1920 b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe"C:\Users\Admin\AppData\Local\Temp\b94f79a6173ea6a674f7a3269ef67b648629ad73c03a69c8c29261394bb7fe72.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1920