Analysis
-
max time kernel
122s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11-10-2023 16:00
Static task
static1
Behavioral task
behavioral1
Sample
e358f70e7724cbaf5a9092ae6b494a99234ce8c44b9f69702f96a8704fe75c22.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e358f70e7724cbaf5a9092ae6b494a99234ce8c44b9f69702f96a8704fe75c22.exe
Resource
win10v2004-20230915-en
General
-
Target
e358f70e7724cbaf5a9092ae6b494a99234ce8c44b9f69702f96a8704fe75c22.exe
-
Size
10.6MB
-
MD5
f5257eeccec550c85cf97dcc219b6470
-
SHA1
44339e8a8101df6ab06836b7da17bd73d13dc440
-
SHA256
e358f70e7724cbaf5a9092ae6b494a99234ce8c44b9f69702f96a8704fe75c22
-
SHA512
e4e4b4bdd1aca2524486a1178d2739b643e070651dce56d7aaa4f9ef5a611ff547b9053a3c594505e9af2475a7830b636c2208fe780de65f274244d82c12fe00
-
SSDEEP
196608:X7pVkq6zZAFMARdUE+dV7leUnJDIlDcKO5/jE3hQF45cPv5TNXMaZEur:tQuMs67dVheUnJMlDcTERtW5R
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2172 e358f70e7724cbaf5a9092ae6b494a99234ce8c44b9f69702f96a8704fe75c22.exe 2172 e358f70e7724cbaf5a9092ae6b494a99234ce8c44b9f69702f96a8704fe75c22.exe 2172 e358f70e7724cbaf5a9092ae6b494a99234ce8c44b9f69702f96a8704fe75c22.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2172 e358f70e7724cbaf5a9092ae6b494a99234ce8c44b9f69702f96a8704fe75c22.exe 2172 e358f70e7724cbaf5a9092ae6b494a99234ce8c44b9f69702f96a8704fe75c22.exe 2172 e358f70e7724cbaf5a9092ae6b494a99234ce8c44b9f69702f96a8704fe75c22.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2172 e358f70e7724cbaf5a9092ae6b494a99234ce8c44b9f69702f96a8704fe75c22.exe 2172 e358f70e7724cbaf5a9092ae6b494a99234ce8c44b9f69702f96a8704fe75c22.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e358f70e7724cbaf5a9092ae6b494a99234ce8c44b9f69702f96a8704fe75c22.exe"C:\Users\Admin\AppData\Local\Temp\e358f70e7724cbaf5a9092ae6b494a99234ce8c44b9f69702f96a8704fe75c22.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2172
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5f4ac318a68081b2d2d7dd817dfde5f0b
SHA1d6f905f582ccf950919368ce80fb71f3aaf30aec
SHA256f6595e48c3840b0d3d124dd5ad3d03f8fc4e2e114f8ebeb54330a34c5c6b5064
SHA5128629ddfde3d8af8bb8d854bdfcd58f56efbbeb8aeb71396624f2670c3c97966030492e233bbc6e59b038dc5a21576578b17931dee4385b9a3c4232450afe8712