Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20220331-en -
submitted
04-04-2022 02:28
Static task
static1
Behavioral task
behavioral1
Sample
848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe
Resource
win10v2004-20220331-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe
-
Size
29KB
-
MD5
7e00c92e3863027f5850713fd001d42d
-
SHA1
1d55ec956747f3e791204f3d1c1184cb53154534
-
SHA256
848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722
-
SHA512
d111065451cea5af5105527c064476b6391662b1240ff9fc8f818e52f027af1c2a7ee2da0b9c854fbdad80fce548a27d6193e1b082945ea83bdffdde2fd5428a
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows installer = "C:\\winstall.exe" 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe Key created \REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe 4076 848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe"C:\Users\Admin\AppData\Local\Temp\848129d3272b3197ec73e305be3c059bf7995004428b9ee0012e3831aa3a7722.exe"1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4076