Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
09/10/2022, 11:51
Static task
static1
Behavioral task
behavioral1
Sample
DesktopOK桌面图标排列备份恢复.exe
Resource
win7-20220901-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
DesktopOK桌面图标排列备份恢复.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
DesktopOK桌面图标排列备份恢复.exe
-
Size
436KB
-
MD5
f930d303ea84da0598dec3242c934faa
-
SHA1
3d4847837f681970ba471bc4ccdfb466908a1b1c
-
SHA256
f6f5486621b12286e1cdced6d9ac05bacf85bfed70f78e790522c62e5f36f019
-
SHA512
9539795aa2bfa90777ca571e2c71d9a21b873297b9c10a57b008a7551e17138bcc51daec6f00a095aae41099071fbf8a3c52ae7503a59060713878a153780072
-
SSDEEP
12288:eEZI8tPfPrruvOtdHPtMOQ6XvH9v4pEhCT:eEDPSOQ6XvH9th2
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DesktopOK桌面图标排列备份恢复.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 2044 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2044 AUDIODG.EXE Token: 33 2044 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2044 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 32 IoCs
pid Process 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe 1284 DesktopOK桌面图标排列备份恢复.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1284 DesktopOK桌面图标排列备份恢复.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DesktopOK桌面图标排列备份恢复.exe"C:\Users\Admin\AppData\Local\Temp\DesktopOK桌面图标排列备份恢复.exe"1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1284
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x57c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2044