Analysis
-
max time kernel
31s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
16-07-2023 03:20
General
-
Target
70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe
-
Size
1.4MB
-
MD5
ed164e11ea8f141236b6196dac5bd879
-
SHA1
d06277b3d82a10ffeced147870a1c7cc65947ae0
-
SHA256
70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45
-
SHA512
996973f75d75a179091211a3d86f91138565add95f7d34089d9610fcfc4ba228c91d1fc830f2f49146db4752270c51702caaf4513fe6cd15df5f5a84427bdd55
-
SSDEEP
24576:7fdsbW0F+Rhk0JgdIpsiwO/QGoWP2qQF+2:O6k0i2qAQGoie
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 22 IoCs
-
Suspicious use of SendNotifyMessage 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe"C:\Users\Admin\AppData\Local\Temp\70fa0912521fe919667f8ba2ab28d1e0239b48d860fe7ce0ac7637b4b7282c45.exe"1⤵
-
C:\Windows\ehome\ehshell.exe"C:\Windows\ehome\ehshell.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
48KB
-
Filesize
1.4MB
-
Filesize
256KB
-
Filesize
6.9MB