712b37f4eb3f459d1efc401b76c10009fea22655783a638baf912f057228ff9b | Triage

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 15:49

Sharing

Report Analysis Logs

General

Target

HideTrayIcon.exe
Size

74KB
MD5

6687371cccf584edefcf1f7cfc170d8f
SHA1

1350de550ebfd150d22e18fa2d4eaf89f0b73604
SHA256

712b37f4eb3f459d1efc401b76c10009fea22655783a638baf912f057228ff9b
SHA512

c77ac67eac5257d43f56d88d58ae1800edef6785566623cc47f48b0d4de3e542c55be122e0dd0e110686d91377a27e279c30b1f2c0096b3f57c85789c143438a
SSDEEP

1536:gOX+tnsdr7TEP9+XJnc3QtnZCOo3lVfTcNAMgu0mPc:rXCS/EVzQtKVZzu03

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2596	taskmgr.exe
2596	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	taskmgr.exe
Token: SeSystemProfilePrivilege	2596	taskmgr.exe
Token: SeCreateGlobalPrivilege	2596	taskmgr.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe
2596	taskmgr.exe

C:\Users\Admin\AppData\Local\Temp\HideTrayIcon.exe
"C:\Users\Admin\AppData\Local\Temp\HideTrayIcon.exe"
1⤵
PID:632

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads