24edd334903a81b7b2eaf69e1370ac078d3349c35d1735703b83ce8e4a5bfae9 | Triage

Analysis

max time kernel
102s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2023, 13:55

Sharing

Report Analysis Logs

General

Target

FtpServer.exe
Size

76KB
MD5

8d3fe47e6ee5e8386a17a37233513e39
SHA1

68001cadf300aa1292cd0e77e453ec2c403a02c5
SHA256

24edd334903a81b7b2eaf69e1370ac078d3349c35d1735703b83ce8e4a5bfae9
SHA512

f2612cc061ce83c4f7f6cd650a8989ff89fc77a365efba4949ba70da2daf21160a81413ecd5fa568394394490f5c2aabe97d04e6e0b6c7f73f0e7bfb9a92b981
SSDEEP

1536:zfI0ZAd99xuzt17ZJD/drmooqIzjgE4t:zTAd99o9ZJDVrmU

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	FtpServer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2164	FtpServer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2164	FtpServer.exe
2164	FtpServer.exe

C:\Users\Admin\AppData\Local\Temp\FtpServer.exe
"C:\Users\Admin\AppData\Local\Temp\FtpServer.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads