Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16/10/2023, 15:59
Static task
static1
Behavioral task
behavioral1
Sample
0a113a10740cbc424cb30cc914173a891fd6efd60f4960ea98f9a6939b290563.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0a113a10740cbc424cb30cc914173a891fd6efd60f4960ea98f9a6939b290563.exe
Resource
win10v2004-20230915-en
General
-
Target
0a113a10740cbc424cb30cc914173a891fd6efd60f4960ea98f9a6939b290563.exe
-
Size
9.7MB
-
MD5
c472ae4dace4ea45735595169107228b
-
SHA1
c9e9c3dea96643647f8f79432f3fcdebe38b2bf6
-
SHA256
0a113a10740cbc424cb30cc914173a891fd6efd60f4960ea98f9a6939b290563
-
SHA512
97e0da5cda6e4797db21cfdda32d78b8e68286c5f13456d0b2cd4d18d6a21813c72fa8c60c425be8cb6869ddd3f9c3f32b570c9cbf62008263f61499f0d2c67a
-
SSDEEP
98304:C49m4qNlDuWkZ4/0n5cWWqUi1os3G+77/bOtIzZ1w6b9Z8BV2q5p:tqNe4yfn2M7/bOCzHTJyBsq5
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2208 0a113a10740cbc424cb30cc914173a891fd6efd60f4960ea98f9a6939b290563.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2208 0a113a10740cbc424cb30cc914173a891fd6efd60f4960ea98f9a6939b290563.exe 2208 0a113a10740cbc424cb30cc914173a891fd6efd60f4960ea98f9a6939b290563.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2208 0a113a10740cbc424cb30cc914173a891fd6efd60f4960ea98f9a6939b290563.exe 2208 0a113a10740cbc424cb30cc914173a891fd6efd60f4960ea98f9a6939b290563.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2208 0a113a10740cbc424cb30cc914173a891fd6efd60f4960ea98f9a6939b290563.exe 2208 0a113a10740cbc424cb30cc914173a891fd6efd60f4960ea98f9a6939b290563.exe 2208 0a113a10740cbc424cb30cc914173a891fd6efd60f4960ea98f9a6939b290563.exe 2208 0a113a10740cbc424cb30cc914173a891fd6efd60f4960ea98f9a6939b290563.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a113a10740cbc424cb30cc914173a891fd6efd60f4960ea98f9a6939b290563.exe"C:\Users\Admin\AppData\Local\Temp\0a113a10740cbc424cb30cc914173a891fd6efd60f4960ea98f9a6939b290563.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2208