728a6c56e86e049d7b1a5b3aa1826b0b43db2c4a5817ff17bb6dd5cc4e4f0f9a

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Anti-AFK/Anti-AFK(x64).exe
Size

1.1MB
MD5

323e5578564b18bc61f341ab4f9a2ff4
SHA1

539db5b898cf4b5905002e7bf540053e77e373a6
SHA256

1c0aebe60a4027b38ffd0324b8e0654b34d8a954844f4db346b40291892bd9f1
SHA512

d085c4b5367e444aff7872cfdde0dd58e526ab968c6e194929b40b10e8d31837db7ad1d8b86352e421a4fb4114bcf7f9eabcac56a6b3f774827d3aac59de5236
SSDEEP

24576:O2DW/xbHX2YIbCQsu3/PNL7Q/HyZ9Yf5hAselgrg:O2EjXHQsW/PN3QfuqAsegrg

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1588	Anti-AFK(x64).exe
1588	Anti-AFK(x64).exe
1588	Anti-AFK(x64).exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1588	Anti-AFK(x64).exe
1588	Anti-AFK(x64).exe
1588	Anti-AFK(x64).exe

C:\Users\Admin\AppData\Local\Temp\Anti-AFK\Anti-AFK(x64).exe
"C:\Users\Admin\AppData\Local\Temp\Anti-AFK\Anti-AFK(x64).exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...