Analysis
-
max time kernel
37s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-06-2022 07:02
Static task
static1
Behavioral task
behavioral1
Sample
2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe
-
Size
905KB
-
MD5
aaee5f473ed1f17be96f642f9e4058bc
-
SHA1
6a59a9dc5e92e9cfeb5e93f71410fe2a146640a8
-
SHA256
2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723
-
SHA512
6902e5b160dea23257eca5fa10e407fc436a3f181922c76023d09803c55efa74e77484a39f2e083da716616da35f85ed2090073867eba53bcbe53e2bfcab1da7
Score
8/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1888-55-0x0000000000250000-0x0000000000441000-memory.dmp upx behavioral1/memory/1888-56-0x0000000000250000-0x0000000000441000-memory.dmp upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1888-56-0x0000000000250000-0x0000000000441000-memory.dmp autoit_exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exepid Process 1888 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 1888 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 1888 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exepid Process 1888 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 1888 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe 1888 2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe"C:\Users\Admin\AppData\Local\Temp\2a0c397b31f6b926f1d87ee1c6f50a7fae8a22d01ca0446add80440a0022a723.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1888