Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-01-2024 16:33
General
-
Target
TaskSwitchXP.exe
-
Size
61KB
-
MD5
aceb501dc6253d26039cde2fe82a5576
-
SHA1
ec24fd29abfaa6edc33c70398b1103df0a7083e1
-
SHA256
9fd657b28e280ffcd0de863c11c0d9526316a9c45516c3a7fb816db3227014c4
-
SHA512
7c7a4755e5a566eb24adf68ff2f41486389b7df044ce1a26b92c32da838645d913efb07d8d18013f0333311c49b9b90d0d71f44684a3b985d27ff43e555aba91
-
SSDEEP
1536:OPK+ruVAPGxHhMhGl2Xr79N/9KZH83h9mPKpK8KZKB:O7r5PGxBMhbXr79N/9K5Qk/
Score
7/10
Malware Config
Signatures
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TaskSwitchXP.exe"C:\Users\Admin\AppData\Local\Temp\TaskSwitchXP.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2364-0-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2364-1-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2364-2-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB