We are hiring! Windows Kernel Developer (Remote), apply here!
flash

Ou0ZT4968y.exe

Status: finished
Submission Time: 2022-11-24 19:46:10 +01:00
Malicious
Spyware
Evader

Comments

Tags

  • 32
  • exe
  • trojan

Details

  • Analysis ID:
    753418
  • API (Web) ID:
    1120701
  • Analysis Started:
    2022-11-24 19:46:10 +01:00
  • Analysis Finished:
    2022-11-24 20:01:03 +01:00
  • MD5:
    27b75158dcfeba6b3419bdbb15397584
  • SHA1:
    8a135c4fc3fa7e06bf29537f9cb0298cc2f1c1de
  • SHA256:
    a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
64/100

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run Condition: Run with higher sleep bypass

malicious
64/100

malicious
24/70

URLs

Name Detection
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
https://gcc.gnu.org/bugs/):
https://sectigo.com/CPS0
Click to see the 6 hidden entries
https://studio.youtube.comSAPISIDHASH
https://studio.youtube.comX-Originapplication/jsonContent-TypesessionTokenctx
http://ocsp.sectigo.com0
https://studio.youtube.com
https://studio.youtube.com/reauth
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#

Dropped files

Name File Type Hashes Detection
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Ou0ZT4968y.exe_6d94c01abebf2aab25e322aa91a877df2b8acdd6_dac8cab9_0497fefa\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDFF8.tmp.dmp
Mini DuMP crash report, 14 streams, Fri Nov 25 03:47:14 2022, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1AF.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
#
Click to see the 2 hidden entries
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE24C.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
\Device\ConDrv
ASCII text, with no line terminators
#