Analysis
-
max time kernel
123s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
31-12-2023 13:42
General
-
Target
386f9499f0cf978fa60ef41b65432e1c.exe
-
Size
129KB
-
MD5
386f9499f0cf978fa60ef41b65432e1c
-
SHA1
2d7256944592814d5bf41c7fe04defbae11217e5
-
SHA256
c173092ec274bcb41c5fe1f6c1b6bc3dd3afd85309305b62f4799040335f0b12
-
SHA512
f46216ca77b0c7837d8b1d553ea81ee5db20ce5658ae87518025ad5e37973c534f8e19eb1cb45c3c1bbaa078f477fba0f057f29af713c49dc312e3a99745a6be
-
SSDEEP
3072:DWzRmZuzrCtt5lpqesyXDhp+ezqK3j1GP:QGuzevceDXDh31O
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\386f9499f0cf978fa60ef41b65432e1c.exe"C:\Users\Admin\AppData\Local\Temp\386f9499f0cf978fa60ef41b65432e1c.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx