4a57098d002b6992dccdfb0f80aa51ed0c2aa5111f346a38ef149bf6c2029d8b | Triage

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-07-2022 13:48

Sharing

Report Analysis Logs

General

Target

4a57098d002b6992dccdfb0f80aa51ed0c2aa5111f346a38ef149bf6c2029d8b.exe
Size

1.1MB
MD5

1ab244105ec806cd8a0830627f020773
SHA1

cd50ad68ff527146ec48d14d31dd51154b912ef7
SHA256

4a57098d002b6992dccdfb0f80aa51ed0c2aa5111f346a38ef149bf6c2029d8b
SHA512

ca8fe5eece94f88110a8e9c7112e0ed70744f2d2bc4c48d84033ef84fdbd5f48ef9dc0bb28a305ee4d9848557a21674d878abef136ef52355f3151898c294a15

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

4a57098d002b6992dccdfb0f80aa51ed0c2aa5111f346a38ef149bf6c2029d8b.exe

pid process

1612 4a57098d002b6992dccdfb0f80aa51ed0c2aa5111f346a38ef149bf6c2029d8b.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

4a57098d002b6992dccdfb0f80aa51ed0c2aa5111f346a38ef149bf6c2029d8b.exe

pid process

1612 4a57098d002b6992dccdfb0f80aa51ed0c2aa5111f346a38ef149bf6c2029d8b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

4a57098d002b6992dccdfb0f80aa51ed0c2aa5111f346a38ef149bf6c2029d8b.exe

pid	process
1612	4a57098d002b6992dccdfb0f80aa51ed0c2aa5111f346a38ef149bf6c2029d8b.exe
1612	4a57098d002b6992dccdfb0f80aa51ed0c2aa5111f346a38ef149bf6c2029d8b.exe

C:\Users\Admin\AppData\Local\Temp\4a57098d002b6992dccdfb0f80aa51ed0c2aa5111f346a38ef149bf6c2029d8b.exe
"C:\Users\Admin\AppData\Local\Temp\4a57098d002b6992dccdfb0f80aa51ed0c2aa5111f346a38ef149bf6c2029d8b.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1612

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-54-0x000007FEFBFB1000-0x000007FEFBFB3000-memory.dmp

Filesize
8KB

Download