Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
04/10/2023, 01:50
Behavioral task
behavioral1
Sample
c5d015569d2cfbaee55778501a8a8dff452f8c5c8eb355aec02b1a1f27d32210.exe
Resource
win7-20230831-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
c5d015569d2cfbaee55778501a8a8dff452f8c5c8eb355aec02b1a1f27d32210.exe
Resource
win10v2004-20230915-en
4 signatures
150 seconds
General
-
Target
c5d015569d2cfbaee55778501a8a8dff452f8c5c8eb355aec02b1a1f27d32210.exe
-
Size
1.7MB
-
MD5
9e2c065e0aab6857b91dccea50dbf248
-
SHA1
d33ddd9618b0f9215c7dfdde598d7ee00fdf8fd8
-
SHA256
c5d015569d2cfbaee55778501a8a8dff452f8c5c8eb355aec02b1a1f27d32210
-
SHA512
e65248861da2fb775d53891e327b10ce8d0815646a7d21f3a3d837198b51f4c3f3dd47715e0a2b607db4fe5a8bc1d7959e650ab492c6b08572eb74bb7d012884
-
SSDEEP
49152:9Et/NDrbgfBEan6wYfxMzoq2En/ao+zEJ2oVcq07d/P:a1N/bgfqK6wYfxMzoq53+zdH
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/340-0-0x0000000000400000-0x0000000000889000-memory.dmp upx behavioral1/memory/340-2-0x0000000010000000-0x0000000010018000-memory.dmp upx behavioral1/memory/340-4-0x0000000000400000-0x0000000000889000-memory.dmp upx behavioral1/memory/340-6-0x0000000000400000-0x0000000000889000-memory.dmp upx behavioral1/memory/340-5-0x0000000000400000-0x0000000000889000-memory.dmp upx behavioral1/memory/340-7-0x0000000000400000-0x0000000000889000-memory.dmp upx behavioral1/memory/340-11-0x0000000010000000-0x0000000010018000-memory.dmp upx -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 340 c5d015569d2cfbaee55778501a8a8dff452f8c5c8eb355aec02b1a1f27d32210.exe 340 c5d015569d2cfbaee55778501a8a8dff452f8c5c8eb355aec02b1a1f27d32210.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 340 c5d015569d2cfbaee55778501a8a8dff452f8c5c8eb355aec02b1a1f27d32210.exe 340 c5d015569d2cfbaee55778501a8a8dff452f8c5c8eb355aec02b1a1f27d32210.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 340 c5d015569d2cfbaee55778501a8a8dff452f8c5c8eb355aec02b1a1f27d32210.exe 340 c5d015569d2cfbaee55778501a8a8dff452f8c5c8eb355aec02b1a1f27d32210.exe 340 c5d015569d2cfbaee55778501a8a8dff452f8c5c8eb355aec02b1a1f27d32210.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5d015569d2cfbaee55778501a8a8dff452f8c5c8eb355aec02b1a1f27d32210.exe"C:\Users\Admin\AppData\Local\Temp\c5d015569d2cfbaee55778501a8a8dff452f8c5c8eb355aec02b1a1f27d32210.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:340