Analysis
-
max time kernel
201s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 01:38
Behavioral task
behavioral1
Sample
6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb.exe
Resource
win10v2004-20231215-en
General
-
Target
6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb.exe
-
Size
536KB
-
MD5
d5f9582f8613276907c0a5a028f69ca6
-
SHA1
1cc000a52d791d9f3330bfb2d709d49ad324adba
-
SHA256
6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb
-
SHA512
007283172f14ad7067b921c6a91ba8c81a50bf443f91dfdd9926d83d81736ea30d9a325004ce8e8530e5ee23822bda0bafb74a9f62326575d636fa5867243990
-
SSDEEP
12288:oAg+X5Sb/YtYh+Iyy5p6S7PNsWRdcC/Zl5TxG1qQfc/R1WEDfAnzg:omXkD7yURPbRdcCBPTxoq7n17Is
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2552-0-0x0000000000400000-0x00000000005A2000-memory.dmp upx behavioral1/memory/2552-7-0x0000000000400000-0x00000000005A2000-memory.dmp upx behavioral1/memory/2552-8-0x0000000000400000-0x00000000005A2000-memory.dmp upx -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2552 6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb.exe 2552 6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb.exe 2552 6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb.exe 2552 6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb.exe 2552 6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 2552 6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb.exe 2552 6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb.exe 2552 6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb.exe 2552 6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb.exe 2552 6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb.exe"C:\Users\Admin\AppData\Local\Temp\6fcb7841684182593dfc4e96631739b74dc9c2f8eeba2f2cb4d93b4cabcc73fb.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2552
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39B
MD5ca1af6e0a237f4690bb1b9f8acf40b36
SHA1cef16f8932b8de69e85e75b7871ada10f8124d3c
SHA2566c6b10ab91bbd3e2e644fa1833950a78157bd0fa61ceab12fc3018999d357fea
SHA5125c5de1df3211449d06d1a04ed7f833d69b2f32d95af1cfc5cb6cff7d7bc7eb75732c145532f2a158192437b8a6d11cef180f0f2822bf76bdf06b250bc3f9ce61