Analysis
-
max time kernel
41s -
max time network
84s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 04:26
Behavioral task
behavioral1
Sample
b0171609b6951040fb83054e0be824ad54f4df28ad333266d5867af44fbc6062.exe
Resource
win7-20221111-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
b0171609b6951040fb83054e0be824ad54f4df28ad333266d5867af44fbc6062.exe
Resource
win10v2004-20220812-en
4 signatures
150 seconds
General
-
Target
b0171609b6951040fb83054e0be824ad54f4df28ad333266d5867af44fbc6062.exe
-
Size
922KB
-
MD5
509c0f9767f96072e5c0dfd50856f841
-
SHA1
ecda2c16766817086411bbafefc17affaa10cc9b
-
SHA256
b0171609b6951040fb83054e0be824ad54f4df28ad333266d5867af44fbc6062
-
SHA512
8a39785f11b4007c9153d60c455d031b321f1fef0aaff568b6d5cc47bf639f666d40bd6f72119fde0de7c2dae12b917ae1ffdbf3debb225b63eab6df354d2d62
-
SSDEEP
24576:MBIhkW+zP+Jns5rZf2/1WsBHyp/A/tLEGDqRW4QrVaB:MWh5+zP+Jns14pBHh3Dqw4QB
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1724-55-0x0000000000400000-0x0000000000702000-memory.dmp upx behavioral1/memory/1724-56-0x0000000000400000-0x0000000000702000-memory.dmp upx behavioral1/memory/1724-57-0x0000000000400000-0x0000000000702000-memory.dmp upx -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1724 b0171609b6951040fb83054e0be824ad54f4df28ad333266d5867af44fbc6062.exe 1724 b0171609b6951040fb83054e0be824ad54f4df28ad333266d5867af44fbc6062.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1724 b0171609b6951040fb83054e0be824ad54f4df28ad333266d5867af44fbc6062.exe 1724 b0171609b6951040fb83054e0be824ad54f4df28ad333266d5867af44fbc6062.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1724 b0171609b6951040fb83054e0be824ad54f4df28ad333266d5867af44fbc6062.exe 1724 b0171609b6951040fb83054e0be824ad54f4df28ad333266d5867af44fbc6062.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0171609b6951040fb83054e0be824ad54f4df28ad333266d5867af44fbc6062.exe"C:\Users\Admin\AppData\Local\Temp\b0171609b6951040fb83054e0be824ad54f4df28ad333266d5867af44fbc6062.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1724