Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
09/01/2024, 06:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4da12d2f091757e0cc65f7f333a5cf08.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4da12d2f091757e0cc65f7f333a5cf08.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
4da12d2f091757e0cc65f7f333a5cf08.exe
-
Size
503KB
-
MD5
4da12d2f091757e0cc65f7f333a5cf08
-
SHA1
99864863104a579817b00754e2c588d374c0a5ed
-
SHA256
efe037a0901fd1ee13fa6e98d0ad7294c7cf8b7201f64347f23454adebd0e767
-
SHA512
99ed4720a9a8477984332307a02dbcfcc7b53519aafe66aa89c725360972925d6c2ff5a0576e7df1049e2dca3a6a757f442127beadfe91c55ac658227d9b0a5a
-
SSDEEP
12288:gPKXlzW35pUmrM30sHgKN6id9e3/oTL4XOu82G53:y0gpu4M30YxN68ePY6OuPG5
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Diagnostic = "C:\\Windows\\system32\\diagnostic.exe" 4da12d2f091757e0cc65f7f333a5cf08.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2432 4da12d2f091757e0cc65f7f333a5cf08.exe 2432 4da12d2f091757e0cc65f7f333a5cf08.exe 2432 4da12d2f091757e0cc65f7f333a5cf08.exe 2432 4da12d2f091757e0cc65f7f333a5cf08.exe 2432 4da12d2f091757e0cc65f7f333a5cf08.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 2432 4da12d2f091757e0cc65f7f333a5cf08.exe 2432 4da12d2f091757e0cc65f7f333a5cf08.exe 2432 4da12d2f091757e0cc65f7f333a5cf08.exe 2432 4da12d2f091757e0cc65f7f333a5cf08.exe 2432 4da12d2f091757e0cc65f7f333a5cf08.exe