Analysis
-
max time kernel
162s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-03-2023 06:31
Static task
static1
Behavioral task
behavioral1
Sample
Chat For Windows.exe
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Chat For Windows.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
Chat For Windows.exe
-
Size
730.8MB
-
MD5
90b2b20bc69711d8edad746dab8685d3
-
SHA1
aad714e8d7feb29d1a343feb0ca0caab544041cf
-
SHA256
eeaa0fa73089128a24b7ea391d0f275219ccab76a0a5f97074d9a0bd428fe7c8
-
SHA512
e6ec65fc085f6b30e705d76407117baba80afb2f5d4824ae299f7932b47339fc89f2286eab32e8f17451e04fec7c45e0a596c62498f310b58d8ee19954f6275a
-
SSDEEP
196608:T1Wn/R8B+sdoEeD4An9sDr8Nc3INwbT/Wo9kBa81VR6W:TS/RidoEe81Dr13IsPW
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 944 taskmgr.exe -
Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe 944 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Chat For Windows.exe"C:\Users\Admin\AppData\Local\Temp\Chat For Windows.exe"1⤵PID:2016
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:944