Analysis
-
max time kernel
227s -
max time network
337s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 03:07
Static task
static1
Behavioral task
behavioral1
Sample
8a634e750668217f58c0486bf92c3fb2b889899f4827d62545f7af6e25d6b0cc.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8a634e750668217f58c0486bf92c3fb2b889899f4827d62545f7af6e25d6b0cc.exe
Resource
win10v2004-20221111-en
General
-
Target
8a634e750668217f58c0486bf92c3fb2b889899f4827d62545f7af6e25d6b0cc.exe
-
Size
4.5MB
-
MD5
b0450289945b1afc8ab818d282718d78
-
SHA1
c63c59ca5c19e2546bb0e7c5d402f921644dae8b
-
SHA256
8a634e750668217f58c0486bf92c3fb2b889899f4827d62545f7af6e25d6b0cc
-
SHA512
0efa9f64298025b8512edcc94d51b0325c66c78fb0ef2959b0569a8ff9afedce656580f4437908d0a18090c41c263fed3bc583cc194eb2fe760332f96f96d9e5
-
SSDEEP
98304:ieoKtfSK2+mDbFHQqBiFLOAkGkzdnEVomFHKnPn:iEtKKcGJFLOyomFHKnPn
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 544 8a634e750668217f58c0486bf92c3fb2b889899f4827d62545f7af6e25d6b0cc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 544 8a634e750668217f58c0486bf92c3fb2b889899f4827d62545f7af6e25d6b0cc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 544 8a634e750668217f58c0486bf92c3fb2b889899f4827d62545f7af6e25d6b0cc.exe 544 8a634e750668217f58c0486bf92c3fb2b889899f4827d62545f7af6e25d6b0cc.exe 544 8a634e750668217f58c0486bf92c3fb2b889899f4827d62545f7af6e25d6b0cc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a634e750668217f58c0486bf92c3fb2b889899f4827d62545f7af6e25d6b0cc.exe"C:\Users\Admin\AppData\Local\Temp\8a634e750668217f58c0486bf92c3fb2b889899f4827d62545f7af6e25d6b0cc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:544