Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
17/08/2023, 14:06
Static task
static1
Behavioral task
behavioral1
Sample
7c6293843bcb8f157e41837aa394eaab84ef13e6448182db971db74dab09d0e9.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
7c6293843bcb8f157e41837aa394eaab84ef13e6448182db971db74dab09d0e9.exe
Resource
win10v2004-20230703-en
General
-
Target
7c6293843bcb8f157e41837aa394eaab84ef13e6448182db971db74dab09d0e9.exe
-
Size
385KB
-
MD5
d9dc0a6aabcd0feb85c10dcac4299689
-
SHA1
f8112032f8bcfe1274b22dbc1c75ab4cea17deae
-
SHA256
7c6293843bcb8f157e41837aa394eaab84ef13e6448182db971db74dab09d0e9
-
SHA512
ade855b1e9b378168bfbbdadb47ef9e19ad3ef6f8e352f0d1888fb875a68651ae75da7e7c7d81114e09a8584133378517908261b0a37db99e9368e7e0ab3189b
-
SSDEEP
12288:Y+XQsjesJ+zPYeyIz2KDLynOZaeu5D6OP+MLK4Vp:YpYeznXyOZPufP+MLTVp
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2788 7c6293843bcb8f157e41837aa394eaab84ef13e6448182db971db74dab09d0e9.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2788 7c6293843bcb8f157e41837aa394eaab84ef13e6448182db971db74dab09d0e9.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2788 7c6293843bcb8f157e41837aa394eaab84ef13e6448182db971db74dab09d0e9.exe 2788 7c6293843bcb8f157e41837aa394eaab84ef13e6448182db971db74dab09d0e9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c6293843bcb8f157e41837aa394eaab84ef13e6448182db971db74dab09d0e9.exe"C:\Users\Admin\AppData\Local\Temp\7c6293843bcb8f157e41837aa394eaab84ef13e6448182db971db74dab09d0e9.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2788