Analysis
-
max time kernel
151s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01-04-2023 19:33
Behavioral task
behavioral1
Sample
8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exe
Resource
win10v2004-20230220-en
General
-
Target
8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exe
-
Size
729KB
-
MD5
ebeee5dcab923ffbaf52408049b0920c
-
SHA1
cfc70cab29ef07dd8f8d786ca55c30a96eb63915
-
SHA256
8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e
-
SHA512
53085bd451f741bdf08cc6c6d28b445a2ab8b985707ade2412bbf3b5329fad0331cb677249d4c1183bd7c07a0b87b3f284706c14205d377c4f8957a1f8096024
-
SSDEEP
12288:JGvA1F3/SDFIpwh/LLrA8/kaU10cQNMqV4KuzCKj6CnWg2Re1qU5xTYz1DkC0Lq:ka/p2H+QcQNMqV4Ku+NgQEqU5uz1Dki
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exepid process 1732 8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exe 1732 8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exe 1732 8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exe 1732 8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exepid process 1732 8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exe 1732 8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exe 1732 8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exe 1732 8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exepid process 1732 8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exe"C:\Users\Admin\AppData\Local\Temp\8880e94b69139bc4cfcc43f5125dd29978dff3e13abaf00cf806d8c32be2d17e.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1732