Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
18/09/2023, 01:07
Static task
static1
Behavioral task
behavioral1
Sample
4f9f32ffa7ad24183f06117ec731e7a6801bf2e8da3174710f510d52393e86b4.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4f9f32ffa7ad24183f06117ec731e7a6801bf2e8da3174710f510d52393e86b4.exe
Resource
win10v2004-20230915-en
General
-
Target
4f9f32ffa7ad24183f06117ec731e7a6801bf2e8da3174710f510d52393e86b4.exe
-
Size
6.7MB
-
MD5
a915b7dfdae1e65de8a4fd79055670e9
-
SHA1
1d98b0f84d6468d0c7852b6582df8af6a9146bbb
-
SHA256
4f9f32ffa7ad24183f06117ec731e7a6801bf2e8da3174710f510d52393e86b4
-
SHA512
9fff57ac9fcd2abfd3b4b29f71f4b9bee3cca9ed4d4337580fcbb79709ed77791c0a9c399a2f21fd1bfb8975da5147aae1559a58a77e0e8117f2ac5dd13fe13c
-
SSDEEP
98304:pq+/LaBde0rRWgamPFeuTxHj1g88sZOGg/eHENIjmN:r+BdDr9PF3He88s6GHENZN
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2060 4f9f32ffa7ad24183f06117ec731e7a6801bf2e8da3174710f510d52393e86b4.exe 2060 4f9f32ffa7ad24183f06117ec731e7a6801bf2e8da3174710f510d52393e86b4.exe 2060 4f9f32ffa7ad24183f06117ec731e7a6801bf2e8da3174710f510d52393e86b4.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2060 4f9f32ffa7ad24183f06117ec731e7a6801bf2e8da3174710f510d52393e86b4.exe 2060 4f9f32ffa7ad24183f06117ec731e7a6801bf2e8da3174710f510d52393e86b4.exe 2060 4f9f32ffa7ad24183f06117ec731e7a6801bf2e8da3174710f510d52393e86b4.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2060 4f9f32ffa7ad24183f06117ec731e7a6801bf2e8da3174710f510d52393e86b4.exe 2060 4f9f32ffa7ad24183f06117ec731e7a6801bf2e8da3174710f510d52393e86b4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f9f32ffa7ad24183f06117ec731e7a6801bf2e8da3174710f510d52393e86b4.exe"C:\Users\Admin\AppData\Local\Temp\4f9f32ffa7ad24183f06117ec731e7a6801bf2e8da3174710f510d52393e86b4.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2060