Analysis
-
max time kernel
140s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03-02-2024 01:21
Behavioral task
behavioral1
Sample
8b05e8873fc1f2190eff2ff4a0d2b363.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
8b05e8873fc1f2190eff2ff4a0d2b363.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
8b05e8873fc1f2190eff2ff4a0d2b363.exe
-
Size
930KB
-
MD5
8b05e8873fc1f2190eff2ff4a0d2b363
-
SHA1
558d9e3363197c842eea53ae0fddd8335d8d3600
-
SHA256
050bb50a18fc0f02587c635b3a5a165ec6eb56f14722ff1b00ebff5b6e26f11f
-
SHA512
7b70f8da68f9d6e206d0382ad31f46ab778ea3d54e605cd5f416d57c83b68ff9538d97dad29e9695de29dd5b6b2fcc85887706495c7b710c06b4073c4c63e4d8
-
SSDEEP
24576:RG0aeB8tNXF8fJ31YC3Csx+Szre0zh5Di7Ui5kUMBlfX:RPae7fJORYrbzbBiLslf
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3028-0-0x0000000000400000-0x000000000063F000-memory.dmp upx behavioral1/memory/3028-19-0x0000000000400000-0x000000000063F000-memory.dmp upx -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main 8b05e8873fc1f2190eff2ff4a0d2b363.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3028 8b05e8873fc1f2190eff2ff4a0d2b363.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3028 8b05e8873fc1f2190eff2ff4a0d2b363.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3028 8b05e8873fc1f2190eff2ff4a0d2b363.exe 3028 8b05e8873fc1f2190eff2ff4a0d2b363.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b05e8873fc1f2190eff2ff4a0d2b363.exe"C:\Users\Admin\AppData\Local\Temp\8b05e8873fc1f2190eff2ff4a0d2b363.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3028