08810549d87143439b0293f5772766cacaeebf217d692ddfb776f916f8b582fd | Triage

Resubmissions

19-10-2021 14:03

211019-rcwpqsfhg4 10

19-10-2021 13:56

211019-q8vxmsfhf4 10

15-10-2021 16:42

211015-t719tabbe4 10

Analysis

max time kernel
121s
max time network
125s
platform
windows10_x64
resource
win10-en-20211014
submitted
19-10-2021 13:56

Sharing

Report Analysis Logs

General

Target

4339192e184bea89107928ccd5bcc1f5d4a928922361ab3f999926f74a0f6512.exe
Size

42KB
MD5

d29a5ac669fd239a2df8a7ba6bad4b75
SHA1

b18e00d53474c95fa0720b1720557e4d9a09f161
SHA256

4339192e184bea89107928ccd5bcc1f5d4a928922361ab3f999926f74a0f6512
SHA512

c1e104375d445d7431fd68d0cb6731e459aa0be5b8495bcdca147d0052aa18e4a1f0817d54e2b72489cc9668772c36d6243f716cf542d48a3514f4fb3060a7b6

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

4339192e184bea89107928ccd5bcc1f5d4a928922361ab3f999926f74a0f6512.exe

pid process

4024 4339192e184bea89107928ccd5bcc1f5d4a928922361ab3f999926f74a0f6512.exe

C:\Users\Admin\AppData\Local\Temp\4339192e184bea89107928ccd5bcc1f5d4a928922361ab3f999926f74a0f6512.exe
"C:\Users\Admin\AppData\Local\Temp\4339192e184bea89107928ccd5bcc1f5d4a928922361ab3f999926f74a0f6512.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4024

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...