Analysis
-
max time kernel
225s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
26-11-2022 18:02
General
-
Target
1433_hack44.cn/FTP2013.exe
-
Size
270KB
-
MD5
b195639118d071940cb499bb9a8a0648
-
SHA1
8888ab438cf48c323d4c10a93d2c1c17e5a6c715
-
SHA256
29a66fc45fc4590d3f7c40414c858e6a739e7b27d2180368cf54f80f315d514d
-
SHA512
caec8f36baec8f42d702094c6b3a0cacb39bcb98f7750275daea37d4f9e5cb9f34154a793553850329243ea4f47fd18de867b829a2a0a1210a0d35997aed2e89
-
SSDEEP
6144:+8kobAQG+/elBBGPVa5SpvAddZU4ab9SD2ZWL8u7yErPm7:+8kobAo/iBBm9pvAddZhab9SDPLr3Pm
Score
1/10
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1433_hack44.cn\FTP2013.exe"C:\Users\Admin\AppData\Local\Temp\1433_hack44.cn\FTP2013.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/988-54-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/988-55-0x0000000075E31000-0x0000000075E33000-memory.dmpFilesize
8KB
-
memory/988-56-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB