Analysis
-
max time kernel
141s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/02/2024, 03:07
Behavioral task
behavioral1
Sample
zhua.exe
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
zhua.exe
Resource
win10v2004-20240226-en
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240221-en
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240226-en
0 signatures
150 seconds
General
-
Target
zhua.exe
-
Size
16KB
-
MD5
c9bdbc647b723e56c19c8d1f6b1ef2cf
-
SHA1
d620098be3bd11893f604a0164761e5991746631
-
SHA256
67782e3fe6cb9051b6d08355d7f2d34dcbe894200cdcdf075274b4e7e8b61509
-
SHA512
004a83ee51a93a480069970c9e534c223df2f2a2f1951aa966bd615c5ed2af966cf9fc22be8353b57054036c7fc624b8faaec509b97d2af44a7d700639954adb
-
SSDEEP
192:/T7ZIE8hgiU1NHi+KsVzO3PBAxvwCMrpY7e8LqPZo5LdCfq1Rn6O3I9Fa2eXb:/T7Zf8hgi2Nf0Axvr6+e9Pfqbn1qa
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1384 zhua.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\zhua.exe"C:\Users\Admin\AppData\Local\Temp\zhua.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:1384
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=3112,i,1786399861560734457,5606877702857066305,262144 --variations-seed-version /prefetch:81⤵PID:2104