Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
16-08-2023 05:27
Static task
static1
Behavioral task
behavioral1
Sample
2af5fb94f29beec85af4de52e0062683de29f2b81aae7daa8a0253fee305ceb7.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2af5fb94f29beec85af4de52e0062683de29f2b81aae7daa8a0253fee305ceb7.exe
Resource
win10v2004-20230703-en
General
-
Target
2af5fb94f29beec85af4de52e0062683de29f2b81aae7daa8a0253fee305ceb7.exe
-
Size
1.5MB
-
MD5
0d3fe1568762e3f71f63041a757d94cd
-
SHA1
f476ac1a8846990aa886231b8d1e417eed80c5c3
-
SHA256
2af5fb94f29beec85af4de52e0062683de29f2b81aae7daa8a0253fee305ceb7
-
SHA512
2b391536ff8c978a8c998aa0e2650be9d7a1dd649fa670280180fbbcd1766998f2fa2404254ea89ab67e711fd9820401da56c87183e4d16fcada6140486ee1ce
-
SSDEEP
24576:+WDvPRQuF2/CWp1MHvDLxgeik7U9sjjUJhKACXfUprqHA:XKTpODLee/hjUJhKA/r
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1016 2af5fb94f29beec85af4de52e0062683de29f2b81aae7daa8a0253fee305ceb7.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1016 2af5fb94f29beec85af4de52e0062683de29f2b81aae7daa8a0253fee305ceb7.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1016 2af5fb94f29beec85af4de52e0062683de29f2b81aae7daa8a0253fee305ceb7.exe 1016 2af5fb94f29beec85af4de52e0062683de29f2b81aae7daa8a0253fee305ceb7.exe 1016 2af5fb94f29beec85af4de52e0062683de29f2b81aae7daa8a0253fee305ceb7.exe 1016 2af5fb94f29beec85af4de52e0062683de29f2b81aae7daa8a0253fee305ceb7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2af5fb94f29beec85af4de52e0062683de29f2b81aae7daa8a0253fee305ceb7.exe"C:\Users\Admin\AppData\Local\Temp\2af5fb94f29beec85af4de52e0062683de29f2b81aae7daa8a0253fee305ceb7.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1016