Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 10:00
Behavioral task
behavioral1
Sample
af805a3a11f191b150e7e428c31399b71a2f7609ffe2828806544e680930f8e3.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
af805a3a11f191b150e7e428c31399b71a2f7609ffe2828806544e680930f8e3.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
af805a3a11f191b150e7e428c31399b71a2f7609ffe2828806544e680930f8e3.exe
-
Size
961KB
-
MD5
604c4fb7618eb8919d4a3b0c22fa9a4b
-
SHA1
2fd2dad2c3a08554ef12efa2bc0dd06614dfe2ca
-
SHA256
af805a3a11f191b150e7e428c31399b71a2f7609ffe2828806544e680930f8e3
-
SHA512
83a37f4e4f42a1924a9bc96fc3783784f88e991a669ffd31ccc8fd4a599febda861bfa55432cf4a445ab1510f06f769bbe98fa1113fe4f1aebb0d6b8977c04ce
-
SSDEEP
24576:LUbIaDWwJ41fE5nWVIwwgjrRByjrYw0zbw2QKkUtV:LUbIaYCPQj9ByPYw0zfQMt
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4500-132-0x0000000000400000-0x0000000000716000-memory.dmp upx behavioral2/memory/4500-133-0x0000000000400000-0x0000000000716000-memory.dmp upx behavioral2/memory/4500-134-0x0000000000400000-0x0000000000716000-memory.dmp upx -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4500 af805a3a11f191b150e7e428c31399b71a2f7609ffe2828806544e680930f8e3.exe 4500 af805a3a11f191b150e7e428c31399b71a2f7609ffe2828806544e680930f8e3.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4500 af805a3a11f191b150e7e428c31399b71a2f7609ffe2828806544e680930f8e3.exe 4500 af805a3a11f191b150e7e428c31399b71a2f7609ffe2828806544e680930f8e3.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4500 af805a3a11f191b150e7e428c31399b71a2f7609ffe2828806544e680930f8e3.exe 4500 af805a3a11f191b150e7e428c31399b71a2f7609ffe2828806544e680930f8e3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af805a3a11f191b150e7e428c31399b71a2f7609ffe2828806544e680930f8e3.exe"C:\Users\Admin\AppData\Local\Temp\af805a3a11f191b150e7e428c31399b71a2f7609ffe2828806544e680930f8e3.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4500