Analysis
-
max time kernel
91s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 07:31
Static task
static1
Behavioral task
behavioral1
Sample
9ec109d5e51556ebdf8fa3118b2d952993119b46ac0bd495521a508a6976ecba.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9ec109d5e51556ebdf8fa3118b2d952993119b46ac0bd495521a508a6976ecba.exe
Resource
win10v2004-20220901-en
General
-
Target
9ec109d5e51556ebdf8fa3118b2d952993119b46ac0bd495521a508a6976ecba.exe
-
Size
1.0MB
-
MD5
6dd083493c5bbf3ec9e8cb7f6fc76a0e
-
SHA1
89fe0af07109cf63c20737c7a6999e8a62599a2b
-
SHA256
9ec109d5e51556ebdf8fa3118b2d952993119b46ac0bd495521a508a6976ecba
-
SHA512
9f140d193545272022c4af6ffdcb84559258df0c1b8b30b5bcc6b21050f665350bcafc11dd026cf274cd6c1f5953af2c54551ea947698e43c3d364626cebc85c
-
SSDEEP
12288:K5oWiuHxNtee2aYpUcLBxvtOsR8MYS16ja/FUf10619ptxUs:K5oXWxLUnpBN5t5R8MYS1UqFUi619v
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3040 9ec109d5e51556ebdf8fa3118b2d952993119b46ac0bd495521a508a6976ecba.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3040 9ec109d5e51556ebdf8fa3118b2d952993119b46ac0bd495521a508a6976ecba.exe 3040 9ec109d5e51556ebdf8fa3118b2d952993119b46ac0bd495521a508a6976ecba.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3040 9ec109d5e51556ebdf8fa3118b2d952993119b46ac0bd495521a508a6976ecba.exe 3040 9ec109d5e51556ebdf8fa3118b2d952993119b46ac0bd495521a508a6976ecba.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3040 9ec109d5e51556ebdf8fa3118b2d952993119b46ac0bd495521a508a6976ecba.exe 3040 9ec109d5e51556ebdf8fa3118b2d952993119b46ac0bd495521a508a6976ecba.exe 3040 9ec109d5e51556ebdf8fa3118b2d952993119b46ac0bd495521a508a6976ecba.exe 3040 9ec109d5e51556ebdf8fa3118b2d952993119b46ac0bd495521a508a6976ecba.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ec109d5e51556ebdf8fa3118b2d952993119b46ac0bd495521a508a6976ecba.exe"C:\Users\Admin\AppData\Local\Temp\9ec109d5e51556ebdf8fa3118b2d952993119b46ac0bd495521a508a6976ecba.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3040