Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
23-11-2023 04:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe
Resource
win7-20231023-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe
-
Size
2.3MB
-
MD5
3d1c17db845f49623631f9c14797ebb6
-
SHA1
b51ad88f2e1f33a41e9944f275baba812dfbf5bc
-
SHA256
cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c
-
SHA512
01b6c8415428a9c7a135b77b491709e9f642146f171f28c9cf062cde6c80fddc93c7047a5cd591330d69bfb3713030a979d4e0965bb768b8ac4259b6a5a6802b
-
SSDEEP
49152:qFpraeZW64Alaq5bSUpRiFKsMyYP1dNcpxEldTDCTU/+heIfRs:ipXZW64Ap5bSUpRiXMyIdNoNQ+IMR
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\root\cimv2 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe 2880 cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe"C:\Users\Admin\AppData\Local\Temp\cc8f5b7ddb97f9db75574086fb6014f7aa28adb1aa4defcea7f07589700bed1c.exe"1⤵
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5a4ba0ba460705fa4344179d590c2d1e9
SHA1c2b27167ad869f5f8cda2170b70589f1e143f5b1
SHA256ace238566852cb6800cb136548795938423c2fc4d52564b7cc86a98e60ea9500
SHA512c0d178bc0f5840c92b5e90266f4afc617e78d074abeab0a17d18642dff212a6ac1e03d57db21f856c8805154b425f25e5ded501986d710f3b6871c7513c97dad
