40ae5686af1d386286a4087e18640a47e9a1406f724207c1988c8d118b4be384 | Triage

Analysis

max time kernel
155s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08-07-2022 15:13

Sharing

Report Analysis Logs

General

Target

12ykgyy/kugou.exe
Size

923KB
MD5

e20f4505e1ab652125cba81c140711f3
SHA1

032c588022753ae7934a3bc2eeb1dc9ab8df8afa
SHA256

b4bd05b009f3b77e0ccfaa8255ca8bfce8a5d7ac066c6daa119553ea9eb107e8
SHA512

79a0c9fcf0fb2268418d2d20f8c26c534f835901879d496ddf14ebf966aa768e05c3c513893367b8ad9855f40e15e72f8e8acf1f8e5d3372c420eae072fb4f29

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

kugou.exe

pid process

1864 kugou.exe
1864 kugou.exe
1864 kugou.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

kugou.exe

pid process

1864 kugou.exe
1864 kugou.exe
1864 kugou.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

kugou.exe

pid process

1864 kugou.exe
1864 kugou.exe

C:\Users\Admin\AppData\Local\Temp\12ykgyy\kugou.exe
"C:\Users\Admin\AppData\Local\Temp\12ykgyy\kugou.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-130-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download
memory/1864-131-0x0000000000400000-0x00000000007D3000-memory.dmp

Filesize
3.8MB

Download