Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 02:11
Static task
static1
Behavioral task
behavioral1
Sample
98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0.exe
Resource
win10v2004-20230915-en
General
-
Target
98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0.exe
-
Size
1.6MB
-
MD5
da197a7dedfe9743cc88a33c057f09e3
-
SHA1
c5f9ccf18c6f4b83ca9de964d3ff458348be8bfd
-
SHA256
98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0
-
SHA512
19a31e94ea3d7abbf33a520cac164a4ceb32b1527ac420c9df5225e5e95d0c9aae3c96de1dd51dfa009fb004e6f7492db95e2d11400b0b450a7c5a9749fff86e
-
SSDEEP
49152:i1mRuEqRFh956qLy4KZjoasLyelDTTPuwLkZtPzx4UK:iDEqrToey5ZjoPblPTd4ZtF
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2760 98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0.exe 2760 98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0.exe 2760 98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0.exe 2760 98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2760 98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0.exe 2760 98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0.exe 2760 98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0.exe 2760 98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2760 98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0.exe 2760 98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0.exe"C:\Users\Admin\AppData\Local\Temp\98a157c82661f2e829b6748c456f0f6ca99bb286a56b388a68f64f10031973f0.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2760