Analysis
-
max time kernel
47s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
26-10-2022 23:39
Behavioral task
behavioral1
Sample
8b54425dd1e9a7a6b307d667d07710071e5674d29c231a4c9ca9313cdf29967a.exe
Resource
win7-20220901-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8b54425dd1e9a7a6b307d667d07710071e5674d29c231a4c9ca9313cdf29967a.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
8b54425dd1e9a7a6b307d667d07710071e5674d29c231a4c9ca9313cdf29967a.exe
-
Size
663KB
-
MD5
9e7c052527affe240b7daefa1306e4cf
-
SHA1
4304a16f289147a49363b824ab94b20bac8e3982
-
SHA256
8b54425dd1e9a7a6b307d667d07710071e5674d29c231a4c9ca9313cdf29967a
-
SHA512
3470e335794b457c0fefcbf0263aee470b5e291640d7792e7ce5d21ed091b98548a498b68293778c02513a438edc4dfb96fa7b9cd7db83e927d2efd5e362f448
-
SSDEEP
12288:p5RJl7Xbn9Y+OKfXp5efV2sLwz32K3clln3:xPdrO25G7wQ
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/852-55-0x0000000000400000-0x00000000005F0000-memory.dmp upx -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 852 8b54425dd1e9a7a6b307d667d07710071e5674d29c231a4c9ca9313cdf29967a.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 852 8b54425dd1e9a7a6b307d667d07710071e5674d29c231a4c9ca9313cdf29967a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 852 8b54425dd1e9a7a6b307d667d07710071e5674d29c231a4c9ca9313cdf29967a.exe 852 8b54425dd1e9a7a6b307d667d07710071e5674d29c231a4c9ca9313cdf29967a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b54425dd1e9a7a6b307d667d07710071e5674d29c231a4c9ca9313cdf29967a.exe"C:\Users\Admin\AppData\Local\Temp\8b54425dd1e9a7a6b307d667d07710071e5674d29c231a4c9ca9313cdf29967a.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:852