daabdfc0b1d26d67823e90c4461238a90e9e204123410a4b91205b22c577e41d | Triage

Analysis

max time kernel
35s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05/03/2023, 12:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

1008KB
MD5

f85041913b1c62827494dcd90a84899c
SHA1

e9aecb0679900bcd75619caa4b0009ac75be302d
SHA256

daabdfc0b1d26d67823e90c4461238a90e9e204123410a4b91205b22c577e41d
SHA512

81b76a901644d2f4c9b9daa9f0f0e7b42003d2d3c7f8e00717cd0488245b404ec70a65892402891e8896e7df015427941e0331a7a45ad4cf46766259c460bd2a
SSDEEP

24576:5qDEvCTbMWu7rQYlBQcBiT6rprG8aZrYz0DpaY:5TvC/MTQYxsWR7aZrU0Dpa

Score

1^/10

Malware Config

Signatures

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:{impersonationLevel=impersonate}!\root\cimv2	tmp.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2036	tmp.exe
2036	tmp.exe
2036	tmp.exe
2036	tmp.exe
2036	tmp.exe
2036	tmp.exe
2036	tmp.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2036	tmp.exe
2036	tmp.exe
2036	tmp.exe
2036	tmp.exe
2036	tmp.exe
2036	tmp.exe
2036	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads