Resubmissions
05/02/2025, 06:51
250205-hmnx7swpgk 1005/02/2025, 06:49
250205-hlsvrswpdj 1028/04/2024, 18:31
240428-w6cwyaec5v 1021/04/2024, 08:57
240421-kwwqhsfh8z 1021/04/2024, 05:45
240421-gfvazacf82 1018/04/2024, 19:05
240418-xry2ascb73 1018/04/2024, 16:34
240418-t3alashf75 1004/03/2024, 18:33
240304-w7b12ahg61 10Analysis
-
max time kernel
1329s -
max time network
1162s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
04/03/2024, 18:33
General
-
Target
bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
-
Size
58KB
-
MD5
e777bc84ca195b357d3e762ed397a510
-
SHA1
159268993b0f8b0498ea994ff0b370cca3ed9fd9
-
SHA256
aac437030e9124f5a39f58ede1eedf0a786091efbce4fe697b468d7c2d907ac6
-
SHA512
8ce4ecb25b23db00cc1a492b783f7c84d3564c9a3b81fc236a16f35c4e39c5bb80c4a3fe88d5d37d67c7fc0cf691c276a42f2bbd48009271075e24d9637a807d
-
SSDEEP
768:iamxy0a+qFOdq34MiCahA3A8jCNTVU/1SQLD0JbdW9CxHu+T0C/zI4Rn1YcNLCf:tUy1dZ3DaTK1S6D0JbdW9Cx3T065n3LK
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.SpyGate.exe"C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.SpyGate.exe"1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 12482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 224 -ip 2241⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
80KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
344KB
-
Filesize
7.7MB