Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
17/11/2023, 03:39
Static task
static1
Behavioral task
behavioral1
Sample
a19d1690a17d5d2e7942e1d6b63212c9bf706b40f5261dbf750826a786ebb885.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
a19d1690a17d5d2e7942e1d6b63212c9bf706b40f5261dbf750826a786ebb885.exe
Resource
win10v2004-20231020-en
General
-
Target
a19d1690a17d5d2e7942e1d6b63212c9bf706b40f5261dbf750826a786ebb885.exe
-
Size
9.9MB
-
MD5
b486d2ba40542d058b1dd3d914a70a5f
-
SHA1
e3571d69fb832b4d35153191d6237861749cfa5e
-
SHA256
a19d1690a17d5d2e7942e1d6b63212c9bf706b40f5261dbf750826a786ebb885
-
SHA512
c70b3a9b4aefb19e0f426395bc83852ff7dd4ba026873e7569421f7c162d1b5e37218455c62cb0ef37b5eb2ecbd58b0923b9109817736f250ab4b0de1ad4d4bb
-
SSDEEP
98304:zjyfKnsSscgn8JmymQkicdybFDM9UDOUpu1rdk2RwE34LzYLcdxzGsEQsyHHVwKx:z1AwEI3CcdVGfsnSi4buAdGEHdFmJVH
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1932 a19d1690a17d5d2e7942e1d6b63212c9bf706b40f5261dbf750826a786ebb885.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1932 a19d1690a17d5d2e7942e1d6b63212c9bf706b40f5261dbf750826a786ebb885.exe 1932 a19d1690a17d5d2e7942e1d6b63212c9bf706b40f5261dbf750826a786ebb885.exe 1932 a19d1690a17d5d2e7942e1d6b63212c9bf706b40f5261dbf750826a786ebb885.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1932 a19d1690a17d5d2e7942e1d6b63212c9bf706b40f5261dbf750826a786ebb885.exe 1932 a19d1690a17d5d2e7942e1d6b63212c9bf706b40f5261dbf750826a786ebb885.exe 1932 a19d1690a17d5d2e7942e1d6b63212c9bf706b40f5261dbf750826a786ebb885.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1932 a19d1690a17d5d2e7942e1d6b63212c9bf706b40f5261dbf750826a786ebb885.exe 1932 a19d1690a17d5d2e7942e1d6b63212c9bf706b40f5261dbf750826a786ebb885.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a19d1690a17d5d2e7942e1d6b63212c9bf706b40f5261dbf750826a786ebb885.exe"C:\Users\Admin\AppData\Local\Temp\a19d1690a17d5d2e7942e1d6b63212c9bf706b40f5261dbf750826a786ebb885.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1932
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD563ddccd4ccb787d02c696062882cc927
SHA13c1a6ba2815da0ec018bd38e4c386dbfa57df5f5
SHA256433a649fa5a6bd8dcca316cd79d8ad6fbde814e4fcbc963f4c41dca2c86dd524
SHA512b6d0474c482db227cc4284ff7b4ddb3d278f88e0a7319ae118ee51420bde73b7c796d275a07639918f08eb56828ca636538499c94ad165959a34474775fa418a