df8e314c418962f44f0075b46b9a0291acedab6cbcd60e8c5dd4f63c5a367826

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 10:56

Target

imetool/IMETool.exe
Size

48KB
MD5

dd0e68d44beb42cb82b7a166d33150ab
SHA1

3b021ff0f451851c5ba257a491e26597c7893f57
SHA256

e8a07f29e873b7b471a9817c28915009193fa6dbb6ff0b942a38c110075135f8
SHA512

7b9722146e44c9165d031d37041dd16d0da4e680bbf10ecfc3ff1e5325c4e3c6378b0c28e3129de36d9ec0b64d33e1c60ed7c157ce98851a65f6d21853e6e4ec
SSDEEP

768:Vgkq2Xo/cFwuVDlEwjiHXpeZElTSaFjc2EsrvaIOQXTL9xOynKTuDVJCTt2sXHr9:9ZY/cKmRvIlTSatcjMO+L24VJe2sXr9

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1972-0-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1972-2-0x0000000000400000-0x0000000000426000-memory.dmp	upx

Modifies Control Panel 10 IoCs

evasion

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Input Method\Hot Keys\00000104	IMETool.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Input Method\Hot Keys\0000000	IMETool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Input Method\Hot Keys\0000000\Key Modifiers = 00000000	IMETool.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Input Method\Hot Keys\0000001	IMETool.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Input Method\Hot Keys\0000002	IMETool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Input Method\Hot Keys\0000002\Virtual Key = 00000000	IMETool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Input Method\Hot Keys\0000000\Virtual Key = 00000000	IMETool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Input Method\Hot Keys\0000001\Key Modifiers = 00000000	IMETool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Input Method\Hot Keys\0000001\Virtual Key = 00000000	IMETool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Input Method\Hot Keys\0000002\Key Modifiers = 00000000	IMETool.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

memory/1972-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1972-2-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download