747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f

Analysis

max time kernel
3s
max time network
21s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
Size

1.2MB
MD5

3ce836c2db353abb0ede78c90ca4b956
SHA1

97875f5cb348b28e952789a82fba3905322c4f16
SHA256

747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f
SHA512

224c13dba564710cc88cd565e59e21d816f1154c95f4482927ab883b57b4385842a87a5398305dad12cd717eb800266c425b6253e1affde5bae29b998d2ac066
SSDEEP

24576:Mtb20pksCqT5TBWgNQ7awQVRIPHIHOYlqkLyUZ2CSKd6A:1Pg5tQ7awdPHXUryC55

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
880	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
880	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
880	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
880	747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe

C:\Users\Admin\AppData\Local\Temp\747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
"C:\Users\Admin\AppData\Local\Temp\747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:880
- C:\Users\Admin\AppData\Local\Temp\747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe
  "C:\Users\Admin\AppData\Local\Temp\747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\471612" "C:\Users\Admin\AppData\Local\Temp\747512167a5312b2c074ecc57b057f6c1d58f5d46bbb373687aaed016fab5f9f.exe"
  2⤵
  PID:1052
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    PID:1284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\471612

Filesize
18KB

MD5
4f05ae9813ba8650fb68dfa80fd648c8

SHA1
91d715de6f2a937c810497acf8a647815c7d40ca

SHA256
1ed1cd3d17b48dd1549d7441575eddffbfddb2a0a72894fda9330edae155b216

SHA512
978b5b587cdb9cefb154c8a4c3cd16b40d7cc01d0a33060982ffdf452f2b94f5a0ee880818b0855bec7e926e5a96753db5fe46fe85e1e6d7774dd6f9144c4ff3

Download Submit
C:\Users\Admin\AppData\Local\Temp\incl1

Filesize
18KB

MD5
f1aea9efe24e452d8a9eb0a4842544f7

SHA1
164b9432f979a9cb4d0201e5e0a81b3d495227fe

SHA256
5da7e85eb26c186bfb9c958d7ba60927505d10b98a0085a0ea40ee2bfe4c2805

SHA512
6e6ff192b325ab4504f3048720d612050f9787bc2ed481bdc8440213e68fd1e5b7b2743a216bb46a4e6041d12dca94c439459f6ac5123738e194c59eabbc4c58

Download Submit
C:\Users\Admin\AppData\Local\Temp\incl2

Filesize
38KB

MD5
da762791bd50ce2e673922065e4079c3

SHA1
8978934f2085e927a4a795fc661dc0240293ec08

SHA256
b977088533acc2d4abef9d42b7f0457d146b8c0a5614162c63775736930ab821

SHA512
f27c0104c6736ef6cc3ba996db92757f6d68efde9f913215425c167b17a93aa11e4dc92b1f6624b8a8cf01415f4a958453fbabe723592fe87cb330ed9bb6e76a

Download Submit
memory/880-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1284-81-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-87-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-62-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-67-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-65-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-68-0x0000000000500000-0x0000000000528000-memory.dmp

Filesize
160KB

Download
memory/1284-72-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-60-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-89-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-86-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-84-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-80-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-78-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-76-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-75-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-74-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-73-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-71-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download
memory/1284-70-0x0000000000080000-0x00000000000E0000-memory.dmp

Filesize
384KB

Download