Analysis
-
max time kernel
141s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
24-11-2022 07:31
General
-
Target
hyword/hyword/hycalc.exe
-
Size
26KB
-
MD5
0710f2c3357a6f49f7e172f8e52d5979
-
SHA1
c9ff9afbc09457fa69de90340a5fd9b7aa091d74
-
SHA256
89c4c14ec5bc9b48db546308b1b2359eec0f45c7bf802868a1138f84d6eacc89
-
SHA512
a769e67bf37133d6eebfa55c900b8468936b81e918e0eea11badf81b797194fc1fb402a77ecd66725340bcc10566a62cc23da2684141f4862623ca0167ee92c2
-
SSDEEP
384:myFgGragH/lD4zCyamzZk7hwKNbHh8MUUAxPr6+e9Pfqbn1k5m1N:a0HND4zCyamdk1dHKMUnxeha5km
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\hyword\hyword\hycalc.exe"C:\Users\Admin\AppData\Local\Temp\hyword\hyword\hycalc.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5601⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
72KB