Overview

overview

10

Static

static

5

477890c832...73.exe

windows7_x64

1

477890c832...73.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    40s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    14-07-2022 06:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473.exe

  • Size

    1.6MB

  • MD5

    0c51f2d2491935aa18675a7a0d91a9ff

  • SHA1

    aedc0da5d909d665bfe1e4de023a163fb24c8847

  • SHA256

    477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473

  • SHA512

    85cc9f0e5bd848ca5f871c645d613a53de98245a558e111662f2c6870f7e0a36c4aa47bbb12c3ee001c083f14ada6f98dc3210161be3cde99c1a98f670c9aedc

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473.exe
    "C:\Users\Admin\AppData\Local\Temp\477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Users\Admin\AppData\Local\Temp\477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473.exe
      "C:\Users\Admin\AppData\Local\Temp\477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473.exe"
      2⤵
        PID:908
      • C:\Users\Admin\AppData\Local\Temp\477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473.exe
        "C:\Users\Admin\AppData\Local\Temp\477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473.exe"
        2⤵
          PID:1860
        • C:\Users\Admin\AppData\Local\Temp\477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473.exe
          "C:\Users\Admin\AppData\Local\Temp\477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473.exe"
          2⤵
            PID:1632
          • C:\Users\Admin\AppData\Local\Temp\477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473.exe
            "C:\Users\Admin\AppData\Local\Temp\477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473.exe"
            2⤵
              PID:1864
            • C:\Users\Admin\AppData\Local\Temp\477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473.exe
              "C:\Users\Admin\AppData\Local\Temp\477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473.exe"
              2⤵
                PID:944
              • C:\Users\Admin\AppData\Local\Temp\477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473.exe
                "C:\Users\Admin\AppData\Local\Temp\477890c8323400fc28599a57f1472618f4f4d9c2f9e5a9f65f2614951f089473.exe"
                2⤵
                  PID:536

              Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/1384-54-0x0000000076011000-0x0000000076013000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1384-55-0x0000000000BF0000-0x0000000000C4B000-memory.dmp

                Filesize

                364KB

                Download