Analysis
- max time kernel
30s - max time network
34s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system - submitted
19/04/2023, 16:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4496BLaIowTwVrzSDZADSXwDAFEO.exe
Resource
win7-20230220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4496BLaIowTwVrzSDZADSXwDAFEO.exe
Resource
win10v2004-20230220-en
3 signatures
150 seconds
General
- Target 4496BLaIowTwVrzSDZADSXwDAFEO.exe
- Size 1008KB
- Sample230419-tknefadf4z
- SHA256 c3db6233e4fef9f2fbbf0bbe793cca3a0fa391e50b31e135664f779a21630e66
- MD5 baa2c481efee0c4230e6f238827a83a8
- SHA1 aaa37b4498ce3dd68b5cc0b416f076d8977f1fbb
- SHA512 0994e8b14643be71b1adb6490355ab69f1f9e452387a9280900bd49a74e9d2e3aeab79c5b60d017d149fedfa2237d683181d1dddf7c7298d8fd2b611d617be97
- SSDEEP 24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8auLYz0Dpay:mTvC/MTQYxsWR7auLU0Dpa
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:{impersonationLevel=impersonate}!\root\cimv2 4496BLaIowTwVrzSDZADSXwDAFEO.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe - Suspicious use of SendNotifyMessage 8 IoCs
pid Process 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe 928 4496BLaIowTwVrzSDZADSXwDAFEO.exe