Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 12:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WindowsProject4.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
WindowsProject4.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target WindowsProject4.exe
- Size 135KB
- Sample260705-p2cl2scv9s
- SHA256 7cbb805ac7ff25d5df76c3bd1a5b21fe63acc064d878bb5aef20d082d5c8f458
- MD5 e3ed7ead1df9959538debb80a0238977
- SHA1 a4f95a3d9aaa2b95be2697acfcd770411d8f15af
- SHA512 9a972d34a3132ea1a0e7cd1077cf1fd408ced33d429ace3e9adf4575884da52ead4d3e3436f8efec2f2e22bd997e2a5512cdfd1683e1627f06a7a882ab8dbe17
- SSDEEP 768:x7nOJ0m0c0BTWX635dv3P6xglVnRVmn58QB2ojntlGCP29Sbh9Sb:x7nM0TcrX635R3P6xEVnRw5R2oznkC
- TLSH T1D8D382138AEC3CDAC13897B0B77B87C0CB2EEC9596A1D48E97C00995C8BD5577A267C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Windows\CurrentVersion\Run\CatClawC2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsProject4.exe" WindowsProject4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Windows\CurrentVersion\Run\CatClawC2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsProject4.exe" WindowsProject4.exe - Contacts third-party web service commonly abused for C2 1 TTPs 18 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 20 discord.com 16 discord.com 17 discord.com 1 discord.com 4 discord.com 8 discord.com 9 discord.com 14 discord.com 2 discord.com 6 discord.com 21 discord.com 5 discord.com 10 discord.com 12 discord.com 3 discord.com 15 discord.com 18 discord.com 19 discord.com - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4568 WindowsProject4.exe 3628 WindowsProject4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WindowsProject4.exe"C:\Users\Admin\AppData\Local\Temp\WindowsProject4.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4568
-
C:\Users\Admin\AppData\Local\Temp\WindowsProject4.exeC:\Users\Admin\AppData\Local\Temp\WindowsProject4.exe1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3628