Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 04:19
Behavioral task
behavioral1
Sample
ba7f0ab74aa20bd7c0644376fb18e161.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ba7f0ab74aa20bd7c0644376fb18e161.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
ba7f0ab74aa20bd7c0644376fb18e161.exe
-
Size
232KB
-
MD5
ba7f0ab74aa20bd7c0644376fb18e161
-
SHA1
cb4dbbf73b52fb79246ff360f74e71a10c4a942f
-
SHA256
e38aebca499cd942ccc8a3e77d6fd804ab7d70a5b4bf8362342ef03090a9ccd9
-
SHA512
e4f5585c6fa7574dc33be4cdb06b50cb0be1569fc85b18a0c3a4cf148fe9b40e3f5800799ba5c80e4fea87c31e53a40586fbd38d7940d65329af4a6812624717
-
SSDEEP
6144:xknN4CVUIm6uk06ZLYgvBA+8xmrxgmA+3cclptVopA7pbU:GnNhuBoY8SorxgmA+nlvVlpU
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4368-0-0x0000000000400000-0x0000000000496000-memory.dmp upx behavioral2/memory/4368-1-0x0000000000400000-0x0000000000496000-memory.dmp upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4368-1-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe 4368 ba7f0ab74aa20bd7c0644376fb18e161.exe