Overview
overview
10Static
static
10AnyDesk v3...V).exe
windows10-2004-x64
1DLL Explor...32.exe
windows10-2004-x64
7DLL Explor...64.exe
windows10-2004-x64
7DLL UnInje...or.exe
windows10-2004-x64
1Everything...ng.exe
windows10-2004-x64
7Everything...up.exe
windows10-2004-x64
4LastActivi...ew.exe
windows10-2004-x64
9LastActivi...ew.bat
windows10-2004-x64
9Lastproverka.bat
windows10-2004-x64
3NirCMD 2.8...md.exe
windows10-2004-x64
9NirCMD 2.8...xe.bat
windows10-2004-x64
9NirCMD 2.8...xe.bat
windows10-2004-x64
9OpenedFile...32.exe
windows10-2004-x64
9OpenedFile...64.exe
windows10-2004-x64
8Process Hacker 2.lnk
windows10-2004-x64
3Recuva 1.5...le.exe
windows10-2004-x64
7Shellbag_a...er.exe
windows10-2004-x64
10USBDeview ...ew.exe
windows10-2004-x64
9UserAssist...ew.exe
windows10-2004-x64
9processhac...up.exe
windows10-2004-x64
7Resubmissions
19-10-2023 11:09
231019-m9hf6agh68 10Analysis
-
max time kernel
600s -
max time network
447s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-ja -
resource tags
arch:x64arch:x86image:win10v2004-20230915-jalocale:ja-jpos:windows10-2004-x64systemwindows -
submitted
19-10-2023 11:09
Behavioral task
behavioral1
Sample
AnyDesk v3.6.3 (аналог TV).exe
Resource
win10v2004-20230915-ja
Behavioral task
behavioral2
Sample
DLL Explorer 1.2/DLLExplorer32.exe
Resource
win10v2004-20230915-ja
Behavioral task
behavioral3
Sample
DLL Explorer 1.2/DLLExplorer64.exe
Resource
win10v2004-20230915-ja
Behavioral task
behavioral4
Sample
DLL UnInjector 1.3/NVTDLLUnInjector.exe
Resource
win10v2004-20230915-ja
Behavioral task
behavioral5
Sample
Everything 1.4.1.877/Everything.exe
Resource
win10v2004-20230915-ja
Behavioral task
behavioral6
Sample
Everything-1.4.1.1022.x86-Setup.exe
Resource
win10v2004-20230915-ja
Behavioral task
behavioral7
Sample
LastActivityView 1.2.7/LastActivityView.exe
Resource
win10v2004-20230915-ja
Behavioral task
behavioral8
Sample
LastActivityView 1.2.7/Сохранить отчет LastActivityView.bat
Resource
win10v2004-20230915-ja
Behavioral task
behavioral9
Sample
Lastproverka.bat
Resource
win10v2004-20230915-ja
Behavioral task
behavioral10
Sample
NirCMD 2.8.1/nircmd.exe
Resource
win10v2004-20230915-ja
Behavioral task
behavioral11
Sample
NirCMD 2.8.1/Скриншот hl2.exe.bat
Resource
win10v2004-20230915-ja
Behavioral task
behavioral12
Sample
NirCMD 2.8.1/Скриншот ucp.exe.bat
Resource
win10v2004-20230915-ja
Behavioral task
behavioral13
Sample
OpenedFilesView 1.80/OpenedFilesView_32.exe
Resource
win10v2004-20230915-ja
Behavioral task
behavioral14
Sample
OpenedFilesView 1.80/OpenedFilesView_64.exe
Resource
win10v2004-20230915-ja
Behavioral task
behavioral15
Sample
Process Hacker 2.lnk
Resource
win10v2004-20230915-ja
Behavioral task
behavioral16
Sample
Recuva 1.53.1087 Pro & Portable/Recuva_Portable.exe
Resource
win10v2004-20230915-ja
Behavioral task
behavioral17
Sample
Shellbag_analyzer_cleaner.exe
Resource
win10v2004-20230915-ja
Behavioral task
behavioral18
Sample
USBDeview 2.73/USBDeview.exe
Resource
win10v2004-20230915-ja
Behavioral task
behavioral19
Sample
UserAssistView 1.0.2/UserAssistView.exe
Resource
win10v2004-20230915-ja
Behavioral task
behavioral20
Sample
processhacker-2.39-setup.exe
Resource
win10v2004-20230915-ja
General
-
Target
UserAssistView 1.0.2/UserAssistView.exe
-
Size
30KB
-
MD5
f36530f46a34516be38521ee9a134d28
-
SHA1
47f0553e0a0febbef59fd9a32149497bbdd5229c
-
SHA256
bc11c4150bbc6f8b2cf7bc96bedbb183c61d53ab8e4052b15d58bad6b6d1befa
-
SHA512
5c1a1282ffc25409d0044770c80e92f7a89fb40567dbb24f64f46750083bb30b842a63ef58b8b9433fa5a5903a5aa7bf71ee941709365c6bc17a9f4d85b1ad5d
-
SSDEEP
384:IecsPHRggjhCnMgZas8+oAEqPm63AovtX625wWMPODVDSt/U/BEUxhUp5Erzrbqu:HhCWSrPlX62arODxS1U/Br9nrbqUo
Malware Config
Signatures
-
Nirsoft 1 IoCs
resource yara_rule behavioral19/memory/4904-1-0x0000000000400000-0x0000000000416000-memory.dmp Nirsoft -
resource yara_rule behavioral19/memory/4904-0-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral19/memory/4904-1-0x0000000000400000-0x0000000000416000-memory.dmp upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4904 UserAssistView.exe