Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 10:00
Behavioral task
behavioral1
Sample
48accbe07defaf7e7f3a13aeb21e2bf3.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
48accbe07defaf7e7f3a13aeb21e2bf3.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
48accbe07defaf7e7f3a13aeb21e2bf3.exe
-
Size
830KB
-
MD5
48accbe07defaf7e7f3a13aeb21e2bf3
-
SHA1
1e03fb17508557ac8c749f8b3a3bb3ab1d3368e3
-
SHA256
06f44b0b83743eb64900d7c47d1d046081ef1f0f210fd0941b2c887475323187
-
SHA512
30d9ae11b09ece0963c5a292c27417aee51a5d423a5910e8e123cb6ee5d5858f12ed498dd5a4aafb17c59ca6976edd1b3b516001861a3892192c65e0a494965d
-
SSDEEP
24576:4gUOGuCR3scwwKIU8UEKTBgpioRaeTpzWKcMOD5:2wCdscACUEKTBgpNYeVzWBM
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2460-0-0x0000000000400000-0x00000000006B4000-memory.dmp upx behavioral1/memory/2460-6-0x0000000000400000-0x00000000006B4000-memory.dmp upx behavioral1/memory/2460-7-0x0000000000400000-0x00000000006B4000-memory.dmp upx -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main 48accbe07defaf7e7f3a13aeb21e2bf3.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2460 48accbe07defaf7e7f3a13aeb21e2bf3.exe 2460 48accbe07defaf7e7f3a13aeb21e2bf3.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2460 48accbe07defaf7e7f3a13aeb21e2bf3.exe 2460 48accbe07defaf7e7f3a13aeb21e2bf3.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2460 48accbe07defaf7e7f3a13aeb21e2bf3.exe 2460 48accbe07defaf7e7f3a13aeb21e2bf3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48accbe07defaf7e7f3a13aeb21e2bf3.exe"C:\Users\Admin\AppData\Local\Temp\48accbe07defaf7e7f3a13aeb21e2bf3.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2460