Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2023 10:56
Static task
static1
Behavioral task
behavioral1
Sample
03e0bd9468fffe9966c093e50274a66d5000339bc52afff19ae6f0602035e330.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
03e0bd9468fffe9966c093e50274a66d5000339bc52afff19ae6f0602035e330.exe
Resource
win10v2004-20230220-en
General
-
Target
03e0bd9468fffe9966c093e50274a66d5000339bc52afff19ae6f0602035e330.exe
-
Size
119KB
-
MD5
1902d4c04832ddadb06d1282a8590791
-
SHA1
6b74cf9acb858d7bc0fb78fef418d40d6870c39c
-
SHA256
03e0bd9468fffe9966c093e50274a66d5000339bc52afff19ae6f0602035e330
-
SHA512
b828b945fa8ffb4b72eaa196f75112452a8421ea45d9a34f342a6b1d93a482bf62706f94f3c5de243e7ddaeadced04a16a64dd15567472210f355083efd5fe89
-
SSDEEP
768:C5ykTqKTSelZLBmZUfXlejCN52RK4noIFGggg:C59TDTZLBCUfICN8K4noIFGggg
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4784 03e0bd9468fffe9966c093e50274a66d5000339bc52afff19ae6f0602035e330.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4784 03e0bd9468fffe9966c093e50274a66d5000339bc52afff19ae6f0602035e330.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\03e0bd9468fffe9966c093e50274a66d5000339bc52afff19ae6f0602035e330.exe"C:\Users\Admin\AppData\Local\Temp\03e0bd9468fffe9966c093e50274a66d5000339bc52afff19ae6f0602035e330.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4784