Analysis
-
max time kernel
123s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2023, 15:05
Static task
static1
Behavioral task
behavioral1
Sample
76bb977ff1948dbc8d7b1f13e674b5351d21b304d2f141d01238bbdc112f9fa2.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
76bb977ff1948dbc8d7b1f13e674b5351d21b304d2f141d01238bbdc112f9fa2.exe
Resource
win10v2004-20231020-en
General
-
Target
76bb977ff1948dbc8d7b1f13e674b5351d21b304d2f141d01238bbdc112f9fa2.exe
-
Size
787KB
-
MD5
fed57a7e4129f4a29c1505a64b4b872e
-
SHA1
60559576f2fbebf6f3c9c9f6c6a8c7c85de3d2d8
-
SHA256
76bb977ff1948dbc8d7b1f13e674b5351d21b304d2f141d01238bbdc112f9fa2
-
SHA512
562cf694d06d1d9d2da4efcb6097a97548932bb9e600e63c2329f0883a408587df29233776ad0faa2d76ed39ce778f461a4e337b578f1552a04adddbaaa0c78d
-
SSDEEP
12288:ZgxO/6wNiZDVH42OHKFfQrvf7luKXJsJSo0g6VGGzwbNqU:ZgxO/qll4LHKZC37oKXJQ0g6VdCv
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 932 76bb977ff1948dbc8d7b1f13e674b5351d21b304d2f141d01238bbdc112f9fa2.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 932 76bb977ff1948dbc8d7b1f13e674b5351d21b304d2f141d01238bbdc112f9fa2.exe 932 76bb977ff1948dbc8d7b1f13e674b5351d21b304d2f141d01238bbdc112f9fa2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\76bb977ff1948dbc8d7b1f13e674b5351d21b304d2f141d01238bbdc112f9fa2.exe"C:\Users\Admin\AppData\Local\Temp\76bb977ff1948dbc8d7b1f13e674b5351d21b304d2f141d01238bbdc112f9fa2.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:932