Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 01:49
Behavioral task
behavioral1
Sample
0aa6717c52e7d9f6c990c379f25915e1.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
0aa6717c52e7d9f6c990c379f25915e1.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
0aa6717c52e7d9f6c990c379f25915e1.exe
-
Size
123KB
-
MD5
0aa6717c52e7d9f6c990c379f25915e1
-
SHA1
92d3c1d9d773491c18c1a3545eb44de0ef2cf4c0
-
SHA256
6cf55acb267d02d8c0794abf589d759b7c8b2d216fec453e5596f3f3bf3800e7
-
SHA512
61ca3e6bf98235e03b857f9234014081f82aea731ef6db9bc1bac77c1985dcbf890f5ea960cb962f2ca1f85f1056ab41ddc0596532292ddb9b7f3074be22fb91
-
SSDEEP
3072:nb9Sb1K9HK4CTbdcsvFWj+eDafue7o0qQk0BVkY3Poutu:n5SbwRK4CTbd9W7Dan7o0TBVkEPoS
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4820-0-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4820-17-0x0000000000400000-0x0000000000458000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e94cef073b61b2bf6f3ad57adcd08b4f = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0AA671~1.EXE /r" 0aa6717c52e7d9f6c990c379f25915e1.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4820 0aa6717c52e7d9f6c990c379f25915e1.exe 4820 0aa6717c52e7d9f6c990c379f25915e1.exe 4820 0aa6717c52e7d9f6c990c379f25915e1.exe 4820 0aa6717c52e7d9f6c990c379f25915e1.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 4820 0aa6717c52e7d9f6c990c379f25915e1.exe 4820 0aa6717c52e7d9f6c990c379f25915e1.exe 4820 0aa6717c52e7d9f6c990c379f25915e1.exe 4820 0aa6717c52e7d9f6c990c379f25915e1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4820 0aa6717c52e7d9f6c990c379f25915e1.exe 4820 0aa6717c52e7d9f6c990c379f25915e1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aa6717c52e7d9f6c990c379f25915e1.exe"C:\Users\Admin\AppData\Local\Temp\0aa6717c52e7d9f6c990c379f25915e1.exe"1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4820