Analysis
-
max time kernel
92s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-02-2023 20:21
Behavioral task
behavioral1
Sample
df92b52c8f0c0aa9c652c24205c4eaee1d8836044177cbad297a55cc7bacd833.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
df92b52c8f0c0aa9c652c24205c4eaee1d8836044177cbad297a55cc7bacd833.exe
Resource
win10v2004-20230220-en
General
-
Target
df92b52c8f0c0aa9c652c24205c4eaee1d8836044177cbad297a55cc7bacd833.exe
-
Size
3.3MB
-
MD5
52ad6b1e43214fd8376e0f5ce0aef32c
-
SHA1
0ba7fb1e2be5197e8b234fa59d4ad4f1a230ebbb
-
SHA256
df92b52c8f0c0aa9c652c24205c4eaee1d8836044177cbad297a55cc7bacd833
-
SHA512
e8c8b1d9aa13c24996e5efe4b3b3eaa599f9add0de6680785c164c9a49d666f7aff92c38b74a671ff8f82a9a343544ff67fbe246c6b154d35562e4eb9d4cb0d0
-
SSDEEP
98304:FkHw3kpgv1wVH0E9A2PkyKtrbXMYkVOh3DiLA:qePQ0EO4KtrbRi2
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
df92b52c8f0c0aa9c652c24205c4eaee1d8836044177cbad297a55cc7bacd833.exepid process 1428 df92b52c8f0c0aa9c652c24205c4eaee1d8836044177cbad297a55cc7bacd833.exe 1428 df92b52c8f0c0aa9c652c24205c4eaee1d8836044177cbad297a55cc7bacd833.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
df92b52c8f0c0aa9c652c24205c4eaee1d8836044177cbad297a55cc7bacd833.exepid process 1428 df92b52c8f0c0aa9c652c24205c4eaee1d8836044177cbad297a55cc7bacd833.exe 1428 df92b52c8f0c0aa9c652c24205c4eaee1d8836044177cbad297a55cc7bacd833.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
df92b52c8f0c0aa9c652c24205c4eaee1d8836044177cbad297a55cc7bacd833.exepid process 1428 df92b52c8f0c0aa9c652c24205c4eaee1d8836044177cbad297a55cc7bacd833.exe 1428 df92b52c8f0c0aa9c652c24205c4eaee1d8836044177cbad297a55cc7bacd833.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df92b52c8f0c0aa9c652c24205c4eaee1d8836044177cbad297a55cc7bacd833.exe"C:\Users\Admin\AppData\Local\Temp\df92b52c8f0c0aa9c652c24205c4eaee1d8836044177cbad297a55cc7bacd833.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1428-133-0x0000000000400000-0x0000000001797000-memory.dmpFilesize
19.6MB
-
memory/1428-134-0x0000000000400000-0x0000000001797000-memory.dmpFilesize
19.6MB
-
memory/1428-135-0x0000000000400000-0x0000000001797000-memory.dmpFilesize
19.6MB
-
memory/1428-136-0x0000000000400000-0x0000000001797000-memory.dmpFilesize
19.6MB
-
memory/1428-138-0x00000000037B0000-0x00000000037B1000-memory.dmpFilesize
4KB
-
memory/1428-137-0x0000000003800000-0x0000000003801000-memory.dmpFilesize
4KB
-
memory/1428-139-0x0000000003820000-0x0000000003821000-memory.dmpFilesize
4KB
-
memory/1428-140-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/1428-141-0x0000000003900000-0x0000000003901000-memory.dmpFilesize
4KB
-
memory/1428-142-0x0000000000400000-0x0000000001797000-memory.dmpFilesize
19.6MB