Overview

overview

3

Static

static

3

rbxfpsunlo...cy.bat

windows7-x64

1

rbxfpsunlo...cy.bat

windows10-2004-x64

1

synfpsunlo...18.exe

windows7-x64

1

synfpsunlo...18.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    27-01-2024 14:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    synfpsunlocker-2018.exe

  • Size

    721KB

  • MD5

    ab64d40dabc3662cb2da682946aa1b82

  • SHA1

    e29328a6a24439aa09c7fecb3e72c925e6ea588c

  • SHA256

    2711faac549164d349941a3cd420f37a05089d4a55966ea99e63e45110858f5d

  • SHA512

    4dc0a76b62db1df8bf5edc7a2a49d093ba802e8624c03f9c36e954f3d29672130ecf7a0f0b578f851c8732e9e8efe0081340fc14c20719132d0f607c1cb657d0

  • SSDEEP

    12288:6grd3XuGW6DCKvAuTXeM9ZNRQJ039K9jpeqKgpbfscf+fNPs/haM6pa6jGIlAnuT:6gkI9Zv+0390scfCMhfIlq94

Score
1/10

Malware Config

Signatures

  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\synfpsunlocker-2018.exe
    "C:\Users\Admin\AppData\Local\Temp\synfpsunlocker-2018.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads