Analysis
-
max time kernel
116s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
15-03-2022 16:32
Static task
static1
Behavioral task
behavioral1
Sample
ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879.exe
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879.exe
-
Size
1.9MB
-
MD5
cfadbb067cbbe594fed876fe1152f40d
-
SHA1
0fdec001b048b52fdbe29e527bdf3a4be675a3e6
-
SHA256
ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879
-
SHA512
849cfd08accf3b24536bf42b160b5aa4d9ba0694ce6488ab4ebc5f0183892697b2bd7f2d6443d5f6346b944f1fc40beb3a6852754d0c0cbb0a23c7b6cd4285d9
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogons.url ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879.exepid process 4772 ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879.exe 4772 ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879.exe 4772 ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879.exepid process 4772 ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879.exe 4772 ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879.exe 4772 ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879.exe"C:\Users\Admin\AppData\Local\Temp\ffa0cf81269e68c80a9d882cbd719633b4e758267359a9b91449312cf904c879.exe"1⤵
- Drops startup file
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4772