Analysis

  • max time kernel
    161s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 23:19

General

  • Target

    1fcea8bf9cb33e19099b0250667980a4.exe

  • Size

    355KB

  • MD5

    1fcea8bf9cb33e19099b0250667980a4

  • SHA1

    d85940ec1a0861be83d25869b7d106a9ce439850

  • SHA256

    3b2b68dee70065b1db6966fd6b13cd0287c6b46b153ce30a2fd4b54ecf8dca27

  • SHA512

    9b5d767396c4148af2cf78f3baed84d30afbbab0d7268067121a4e18476a00180c426ab6e820f1aeec48f3c96a4e41ef943364a633c06867a2992f6b942384da

  • SSDEEP

    6144:EQg6R6F9j4z7WHf09RbMOs02+NfOV9ddrFm6UvjaEo+8NfWxU5F1nqSZK3LR:Jg6ZzS89qODdG9ddrILrCfWxwq3LR

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1fcea8bf9cb33e19099b0250667980a4.exe
    "C:\Users\Admin\AppData\Local\Temp\1fcea8bf9cb33e19099b0250667980a4.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4972

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4972-0-0x0000000000400000-0x00000000004DB000-memory.dmp

          Filesize

          876KB

        • memory/4972-1-0x00000000023A0000-0x00000000023A1000-memory.dmp

          Filesize

          4KB

        • memory/4972-2-0x0000000000400000-0x00000000004DB000-memory.dmp

          Filesize

          876KB

        • memory/4972-4-0x00000000023A0000-0x00000000023A1000-memory.dmp

          Filesize

          4KB