Analysis
-
max time kernel
153s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 12:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6d417b92ba3ff264c8b84bef144a0d59.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
6d417b92ba3ff264c8b84bef144a0d59.exe
-
Size
693KB
-
MD5
6d417b92ba3ff264c8b84bef144a0d59
-
SHA1
f825ddb700b84af269c90f9659013501454a453d
-
SHA256
595e19fe2fc6c3fafa99a772984b5ced63ad8505afb8cf60d171ade0db419901
-
SHA512
60726befb7f45a27c218a38e2e71a3f59a696b229b030e242bcfa9f5c607f2b8e4c21006fb04e2535cd05e0d69be7535fe04e28bf5006895a1831c3ad4643a62
-
SSDEEP
12288:HPqlDAbt2HGn1dlrRe0eBkjvKghJqmMIAp4805TBzHeFE:HCrHGn1bYlkjv5hJ3MIApL05NzWE
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6d417b92ba3ff264c8b84bef144a0d59.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4256 6d417b92ba3ff264c8b84bef144a0d59.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4256 6d417b92ba3ff264c8b84bef144a0d59.exe 4256 6d417b92ba3ff264c8b84bef144a0d59.exe