Analysis
-
max time kernel
168s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2024 14:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3d171361f48dc77544a1b1c9f5b31f75.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
3d171361f48dc77544a1b1c9f5b31f75.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
3d171361f48dc77544a1b1c9f5b31f75.exe
-
Size
1.0MB
-
MD5
3d171361f48dc77544a1b1c9f5b31f75
-
SHA1
c2a5140f25e96f1538b09bd50a1e033201232fe7
-
SHA256
c72ecd8d39b2313068cc5fe58e7e47f79a8c0df842471a0fd70b0bc54dc7b7c2
-
SHA512
bc7c80230d091db237990c4fc3544dea36d3b9a371532a4371c11f74d04c975997c88ee15751714ee08e8733fa644c151c597da18a4895d38f7d306947210d04
-
SSDEEP
24576:MAHnh+eWsN3skA4RV1Hom2KXMmMa3aPVQ1ki5vj5:rh+ZkldoPK8ba3aart
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 www.iplocation.net 25 www.iplocation.net 66 www.iplocation.net -
Program crash 1 IoCs
pid pid_target Process procid_target 3488 3596 WerFault.exe 87 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3596 3d171361f48dc77544a1b1c9f5b31f75.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3596 3d171361f48dc77544a1b1c9f5b31f75.exe 3596 3d171361f48dc77544a1b1c9f5b31f75.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d171361f48dc77544a1b1c9f5b31f75.exe"C:\Users\Admin\AppData\Local\Temp\3d171361f48dc77544a1b1c9f5b31f75.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3596 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 23842⤵
- Program crash
PID:3488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3596 -ip 35961⤵PID:4656