Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
22/09/2023, 03:10
Static task
static1
Behavioral task
behavioral1
Sample
4fda76c93743f3ff35320cf63d391b13ce4c2794cf837e9e12ac6abfca1e26b8.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4fda76c93743f3ff35320cf63d391b13ce4c2794cf837e9e12ac6abfca1e26b8.exe
Resource
win10v2004-20230915-en
General
-
Target
4fda76c93743f3ff35320cf63d391b13ce4c2794cf837e9e12ac6abfca1e26b8.exe
-
Size
14.2MB
-
MD5
d9f4fddf160c223edecec9fb350c6fbf
-
SHA1
59882fbe5018638a97d4eb7f7ce72c9f6d4f5a40
-
SHA256
4fda76c93743f3ff35320cf63d391b13ce4c2794cf837e9e12ac6abfca1e26b8
-
SHA512
4995e613ce6c7bef095a348582300182959d992cd7f1c443904f037f70a7767dc5600979e2728c83b2d1154f2d9ab8282cf7f38be4d844bbd22bf578c57aeead
-
SSDEEP
393216:2eLr0vQPiu6aNatTdQwLwM8yn7NPyHeex/3+PMF:rn0vONiqwkO7d4x/3+P
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2984 4fda76c93743f3ff35320cf63d391b13ce4c2794cf837e9e12ac6abfca1e26b8.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2984 4fda76c93743f3ff35320cf63d391b13ce4c2794cf837e9e12ac6abfca1e26b8.exe 2984 4fda76c93743f3ff35320cf63d391b13ce4c2794cf837e9e12ac6abfca1e26b8.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2984 4fda76c93743f3ff35320cf63d391b13ce4c2794cf837e9e12ac6abfca1e26b8.exe 2984 4fda76c93743f3ff35320cf63d391b13ce4c2794cf837e9e12ac6abfca1e26b8.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2984 4fda76c93743f3ff35320cf63d391b13ce4c2794cf837e9e12ac6abfca1e26b8.exe 2984 4fda76c93743f3ff35320cf63d391b13ce4c2794cf837e9e12ac6abfca1e26b8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fda76c93743f3ff35320cf63d391b13ce4c2794cf837e9e12ac6abfca1e26b8.exe"C:\Users\Admin\AppData\Local\Temp\4fda76c93743f3ff35320cf63d391b13ce4c2794cf837e9e12ac6abfca1e26b8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2984