6c0086b096606c780281d01a1f1873c374bd3d6f2043cb3e591b2c339d7a91e4

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23/11/2023, 20:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6c0086b096606c780281d01a1f1873c374bd3d6f2043cb3e591b2c339d7a91e4.exe
Size

6.5MB
MD5

0c64e052b8d90a2a1df62e2b02bb6053
SHA1

c65d4eb4a3cc910601f5cab0d7d9640649dae28a
SHA256

6c0086b096606c780281d01a1f1873c374bd3d6f2043cb3e591b2c339d7a91e4
SHA512

073930799fd8c018f3555f763459ee9f3a89ed1d0dd2c84a304ed492909b9e70cb524e18c8e194fe5a2888ac8fa0bed7b2a72fc1b4b2955f28228e87c7171a77
SSDEEP

196608:Psm7oMqGJlTTMP+HmMd+4O7NADtV6v+cRsN:1Meo+BdY7XRs

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	6c0086b096606c780281d01a1f1873c374bd3d6f2043cb3e591b2c339d7a91e4.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2116	6c0086b096606c780281d01a1f1873c374bd3d6f2043cb3e591b2c339d7a91e4.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2116	6c0086b096606c780281d01a1f1873c374bd3d6f2043cb3e591b2c339d7a91e4.exe
2116	6c0086b096606c780281d01a1f1873c374bd3d6f2043cb3e591b2c339d7a91e4.exe
2116	6c0086b096606c780281d01a1f1873c374bd3d6f2043cb3e591b2c339d7a91e4.exe
2116	6c0086b096606c780281d01a1f1873c374bd3d6f2043cb3e591b2c339d7a91e4.exe

C:\Users\Admin\AppData\Local\Temp\6c0086b096606c780281d01a1f1873c374bd3d6f2043cb3e591b2c339d7a91e4.exe
"C:\Users\Admin\AppData\Local\Temp\6c0086b096606c780281d01a1f1873c374bd3d6f2043cb3e591b2c339d7a91e4.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-0-0x0000000001270000-0x00000000018EF000-memory.dmp

Filesize
6.5MB

Download
memory/2116-1-0x0000000001270000-0x00000000018EF000-memory.dmp

Filesize
6.5MB

Download