850c3f5563bd2b0e47e36e1fc87b30abbd8d32c150ce78eb2192027c9645cdf8 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 08:45

Sharing

Report Analysis Logs

General

Target

SWF2MP3.exe
Size

264KB
MD5

8be4bd8d7ca73646339626f7a4f3a960
SHA1

a4fe8585d3a9b1ac118b0a1fa8a83551f086b2a4
SHA256

5ac4fbb96ec0b0a348c5e27709d87532a5f3a2fd89b9848beb6add9a3b7974c4
SHA512

03621e53a6cbd10093638408b1ce98dc150a7c8055cd7d453965f3947d37a049da9a4cb8c4e2efe5f5a2aaafd5226ad78c8402cd8f29a818a0ddac2a0e00efc3
SSDEEP

6144:K4Eepht6dqvz282sI8RlPVwwCViPf0lGreL9:KGaWy84S5Vw60lZZ

Score

1^/10

Malware Config

Signatures

Modifies registry class 3 IoCs

Processes:

SWF2MP3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA3290D9-F501-43FF-B112-A6B8D2CD068}	SWF2MP3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA3290D9-F501-43FF-B112-A6B8D2CD068}\HTSTMC = d418b69b1dc17cbd2db5cdacf4d07ca01c55589d0625b66dd5ccfc6467310000b42f4a88dacc8c9678438734884c000097b3ae3f265d000024ca5e9c	SWF2MP3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA3290D9-F501-43FF-B112-A6B8D2CD068}\InprocServer32	SWF2MP3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

SWF2MP3.exe

pid process

1528 SWF2MP3.exe
1528 SWF2MP3.exe

C:\Users\Admin\AppData\Local\Temp\SWF2MP3.exe
"C:\Users\Admin\AppData\Local\Temp\SWF2MP3.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1528-0-0x0000000000400000-0x00000000005AF000-memory.dmp

Filesize
1.7MB

Download
memory/1528-1-0x0000000000400000-0x00000000005AF000-memory.dmp

Filesize
1.7MB

Download