Overview

overview

3

Static

static

ef6a65b9ee...d5.exe

windows7-x64

1

ef6a65b9ee...d5.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    152s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2022, 01:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    ef6a65b9ee3136bd8897dbe6f06724196a42b826c2961f6f7372da6b59bb3ed5.exe

  • Size

    276KB

  • MD5

    6478b780aeacef88270125b50884dfec

  • SHA1

    89fec273a3e7eb6b612b592be44d42e7fbbbe8ed

  • SHA256

    ef6a65b9ee3136bd8897dbe6f06724196a42b826c2961f6f7372da6b59bb3ed5

  • SHA512

    27f18b2156f1dc7e6b41316b83df1fdbc837c3cab5955031236b3d3f92bc386a70db940269d97fd9c7de2295033ba646e105242573f201c0f1596b35317f25a1

  • SSDEEP

    6144:MK5G2f/qVQSmyZu/P4F8SURaXLQFDB4k6Tw:MciFmyZqg2SgaUVBg

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef6a65b9ee3136bd8897dbe6f06724196a42b826c2961f6f7372da6b59bb3ed5.exe
    "C:\Users\Admin\AppData\Local\Temp\ef6a65b9ee3136bd8897dbe6f06724196a42b826c2961f6f7372da6b59bb3ed5.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    PID:576
  • C:\Windows\system32\efsui.exe
    efsui.exe /efs /keybackup
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1616

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/576-54-0x0000000075911000-0x0000000075913000-memory.dmp

          Filesize

          8KB

          Download

        • memory/576-55-0x0000000000250000-0x000000000025F000-memory.dmp

          Filesize

          60KB

          Download

        • memory/1616-56-0x000007FEFBF01000-0x000007FEFBF03000-memory.dmp

          Filesize

          8KB

          Download