Analysis
- max time kernel
146s - max time network
118s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
08/01/2024, 03:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a5b2e047eaa65ef9f5764c902668a5c.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a5b2e047eaa65ef9f5764c902668a5c.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 4a5b2e047eaa65ef9f5764c902668a5c.exe
- Size 422KB
- Sample240108-eb3qfabeh6
- SHA256 e79f7f12d6feb3226e8fe50111a3dc866658e8f96628951b70f0fb4469e1710f
- MD5 4a5b2e047eaa65ef9f5764c902668a5c
- SHA1 4947674abe6ae85ad6587bde76b76fb387aaa494
- SHA512 8904d9be3b3dad39ba9dfe98d0c6bcc339a4be149427e64f953a7d9ad6a6c2d9c51e6950a731505edab6fa9614885abdc25ce46065c79cf5739f332e606cc52d
- SSDEEP 6144:el/9nwOwIgM+OyVvSuZ14IOYuq6n/Dhsn0KSbmn7dF34W:G/dmOYS64IOYH6/RKSQ7daW
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe 5068 4a5b2e047eaa65ef9f5764c902668a5c.exe