Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
02-10-2023 11:41
Behavioral task
behavioral1
Sample
86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe
Resource
win10v2004-20230915-en
General
-
Target
86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe
-
Size
252KB
-
MD5
1cddb043539d037d9f09ae2bc4bd973b
-
SHA1
999839b93b26cc42ae245de3c70981f1d2f3345e
-
SHA256
86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79
-
SHA512
4454840ffcc3f7da12eb6801c368c2e30e7985f5c014fe85576f6e75bf8b1dd854ec11cafc452d7ddb4d6b4cf52120a3d2c1a6aace5aaa0f71384ef9f7288d48
-
SSDEEP
3072:GjCl7hceZbo6eL7+PhvCUxiBZoSiNeL99QDrSkIz8Ml6E3GlU4Ok3fUpJsyvYdza:OCpU6DTiBZo/AeGHx3iU4Ok3yOyiC
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2972-0-0x0000000000400000-0x00000000004BD000-memory.dmp upx behavioral1/memory/2972-2-0x0000000000400000-0x00000000004BD000-memory.dmp upx -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2972 86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe 2972 86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe 2972 86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe 2972 86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe 2972 86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe 2972 86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 2972 86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe 2972 86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe 2972 86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe 2972 86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe 2972 86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe 2972 86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe"C:\Users\Admin\AppData\Local\Temp\86b86640117d79ca76b9aa807704739542baaacf383046d5320c51dce9f63a79.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2972