Analysis
-
max time kernel
160s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2024, 15:54
Static task
static1
Behavioral task
behavioral1
Sample
4147c71d0d6cf3e663e2012d11e57b2b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4147c71d0d6cf3e663e2012d11e57b2b.exe
Resource
win10v2004-20231215-en
General
-
Target
4147c71d0d6cf3e663e2012d11e57b2b.exe
-
Size
1012KB
-
MD5
4147c71d0d6cf3e663e2012d11e57b2b
-
SHA1
d4127d2723df85fbabe8071f79b5484fec4bed94
-
SHA256
74847f17c156c94543449a86672e814c0525ff561482dafc504e30a881f0522c
-
SHA512
f37c4319534914556635739f8c2e70fbb5d438601352918ab6a84ad03e2ad1ea8fc617be7315458b233650652dd05db8e1182042fabbd0044284e6c8657c841d
-
SSDEEP
12288:uaWzgMg7v3qnCiMErQohh0F4CCJ8lny/QiqV1lTfufodP4pe17jjUhI62tqGQGD:ZaHMv6Corjqny/QhV6o2Q17Ul2x
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5024 set thread context of 3392 5024 4147c71d0d6cf3e663e2012d11e57b2b.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3392 4147c71d0d6cf3e663e2012d11e57b2b.exe 3392 4147c71d0d6cf3e663e2012d11e57b2b.exe 3392 4147c71d0d6cf3e663e2012d11e57b2b.exe 3392 4147c71d0d6cf3e663e2012d11e57b2b.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 5024 4147c71d0d6cf3e663e2012d11e57b2b.exe 5024 4147c71d0d6cf3e663e2012d11e57b2b.exe 5024 4147c71d0d6cf3e663e2012d11e57b2b.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 5024 4147c71d0d6cf3e663e2012d11e57b2b.exe 5024 4147c71d0d6cf3e663e2012d11e57b2b.exe 5024 4147c71d0d6cf3e663e2012d11e57b2b.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5024 wrote to memory of 3392 5024 4147c71d0d6cf3e663e2012d11e57b2b.exe 88 PID 5024 wrote to memory of 3392 5024 4147c71d0d6cf3e663e2012d11e57b2b.exe 88 PID 5024 wrote to memory of 3392 5024 4147c71d0d6cf3e663e2012d11e57b2b.exe 88 PID 5024 wrote to memory of 3392 5024 4147c71d0d6cf3e663e2012d11e57b2b.exe 88 PID 5024 wrote to memory of 3392 5024 4147c71d0d6cf3e663e2012d11e57b2b.exe 88 PID 5024 wrote to memory of 3392 5024 4147c71d0d6cf3e663e2012d11e57b2b.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\4147c71d0d6cf3e663e2012d11e57b2b.exe"C:\Users\Admin\AppData\Local\Temp\4147c71d0d6cf3e663e2012d11e57b2b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\4147c71d0d6cf3e663e2012d11e57b2b.exe"C:\Users\Admin\AppData\Local\Temp\4147c71d0d6cf3e663e2012d11e57b2b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3392
-