Analysis

  • max time kernel
    141s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 08:57

General

  • Target

    61b886e9fd9dd0b7dee09dfb11d5fede.exe

  • Size

    323KB

  • MD5

    61b886e9fd9dd0b7dee09dfb11d5fede

  • SHA1

    bc4c0ba27335e205ba8af5e004c0000f7ee8857d

  • SHA256

    5a7c745c7337e7944dd82bbc7e59d703ab1822bdc907c0fa96f23d151561776c

  • SHA512

    dd99b64f1d7adfa1bbfcb46a4427fa1b60c2e002dc3774669c122c33f262142d988b5222920f1f90d9f053b83e60c7211216557035b94f9f6e4950ad2ac2e2de

  • SSDEEP

    6144:Wb3nzbCvJoStFRrfDZYJwJAfUmYomFN5InrfdjfKhhr:+36JoStrfdsfUYrlzKhh

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61b886e9fd9dd0b7dee09dfb11d5fede.exe
    "C:\Users\Admin\AppData\Local\Temp\61b886e9fd9dd0b7dee09dfb11d5fede.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3864-0-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB

  • memory/3864-1-0x0000000002480000-0x0000000002481000-memory.dmp

    Filesize

    4KB

  • memory/3864-2-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB

  • memory/3864-4-0x0000000002480000-0x0000000002481000-memory.dmp

    Filesize

    4KB