Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 01:28
Behavioral task
behavioral1
Sample
0a0cacf755459debbc85542dcfb459b9.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a0cacf755459debbc85542dcfb459b9.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
0a0cacf755459debbc85542dcfb459b9.exe
-
Size
46KB
-
MD5
0a0cacf755459debbc85542dcfb459b9
-
SHA1
ec1724b45e43d070818263a6b4f2a2597823a900
-
SHA256
90eecb32a78ba7d1a2a1143c66f8e38d1b4171bfc1594807352de0f114f7f908
-
SHA512
6c23c4e9eab63bfaa2af2ce288bbd5412248a5f56e43df89ae041a9a8ec2457a7b6ed3d76c9bc1a05947582eb0f4329ac26e9670a15667c8ee1add40e866687a
-
SSDEEP
768:hVUBjdXNxgvhighbEaQY8MvqSsVJMWLGZDW0GjP/5sr6uCMfOwmrNApi0OTDzll:TgXAR4ayPMWdjpWSMf9SNnVTDJ
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5804-0-0x0000000051000000-0x0000000051020000-memory.dmp upx behavioral2/memory/5804-3-0x0000000051000000-0x0000000051020000-memory.dmp upx -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 656 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5804 0a0cacf755459debbc85542dcfb459b9.exe 5804 0a0cacf755459debbc85542dcfb459b9.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 5804 0a0cacf755459debbc85542dcfb459b9.exe 5804 0a0cacf755459debbc85542dcfb459b9.exe