aa69d7ae8051d2978e32cffe160b822c70885061823bd4a6bf7ee23cefa82dda | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 08:01

Sharing

Report Analysis Logs

General

Target

定时关机助手.exe
Size

1013KB
MD5

8d66d22b2066f46ff8d3ba9301c78896
SHA1

3173f994c43a5d281678546768ceb3754cc9718b
SHA256

aa69d7ae8051d2978e32cffe160b822c70885061823bd4a6bf7ee23cefa82dda
SHA512

69b75673698b25c91a8cf8866d917b62f650238bbbd540f0f82ffe6ed6d096cd211a24423805ebd3fd5ded22930a06e83121ec37f144c1363377a17eb4b84414
SSDEEP

24576:GcnDRRffqlN/KNzTPZyNLHtw5wenprTMybT6n:p9ZbwenxTMy3q

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	定时关机助手.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2424	定时关机助手.exe

C:\Users\Admin\AppData\Local\Temp\定时关机助手.exe
"C:\Users\Admin\AppData\Local\Temp\定时关机助手.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2424-57-0x0000000002230000-0x0000000002330000-memory.dmp

Filesize
1024KB

Download
memory/2424-56-0x0000000002230000-0x0000000002330000-memory.dmp

Filesize
1024KB

Download
memory/2424-60-0x0000000002230000-0x0000000002330000-memory.dmp

Filesize
1024KB

Download