Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 00:27
Behavioral task
behavioral1
Sample
088adb05a57d97bd9082ae246ba14d92.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
088adb05a57d97bd9082ae246ba14d92.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
088adb05a57d97bd9082ae246ba14d92.exe
-
Size
877KB
-
MD5
088adb05a57d97bd9082ae246ba14d92
-
SHA1
5b502439165f237e8b7a497c5fa6a7294b289d7a
-
SHA256
e1aef99f1ee543b1c5b5bdc46165a4d3bb1c144bc8c7c0d7046cf6264fe883ce
-
SHA512
4999a116289fef337bed60f4d7aaff2e0052356b6a681358834484ad200e2bfb357842f0faf19a4c34d8ee9b44ad5f1752c078d9692edb6e7840947d88e85f3e
-
SSDEEP
24576:nFE//Tct4bOs5esuehyYX2gc8fcH3yNRRWdBPbuO:FSVITekX8fMORIBPbl
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1256-0-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1256-21-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1256-22-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1256-23-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1256-24-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1256-25-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1256-26-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1256-27-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1256-28-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1256-29-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1256-30-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1256-31-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1256-32-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1256-33-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1256-34-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1256-35-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1256-21-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/memory/1256-22-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/memory/1256-23-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/memory/1256-24-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/memory/1256-25-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/memory/1256-26-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/memory/1256-27-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/memory/1256-28-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/memory/1256-29-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/memory/1256-30-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/memory/1256-31-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/memory/1256-32-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/memory/1256-33-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/memory/1256-34-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral1/memory/1256-35-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1256 088adb05a57d97bd9082ae246ba14d92.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe 1256 088adb05a57d97bd9082ae246ba14d92.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5856f23145244bcbba6e41cdfcd1b0f80
SHA17f02287c57ef8275fb1f001e99119d25c13abfe2
SHA256a3ac02e922faa3a5ce1d5cf6e8dd986bed1cf4ad0605f2c95a678b56c88c6681
SHA512ead646532690227533a730a839b2e679eadd9dc8762d4c2d85629731a092cf1d7203cef45f74d8282882fa50b15afe1d6e5975fd018fe13c5c2fcd8a131b3ce4
