Analysis

  • max time kernel
    159s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2024, 01:56

General

  • Target

    workwinScreen/Ӷ(Ա)/ⰲװɫ/WorkWintv.exe

  • Size

    308KB

  • MD5

    c1fc8c1681f87a3534a36ecae5da85dd

  • SHA1

    9e97bd91c97deb0a2e958911c8941482458032b4

  • SHA256

    587ad15bb2ff490aff122b27114cd0a50d89c54c3c4bdb75c1007bc618a739e5

  • SHA512

    bc6522467b5240bddf2bb879ecec458fae8ab107016c47e5ea75bc46bd474c672f9ac01181627109261aae470dc814876b69e8141c6e7f0a56bc4e9e740347e7

  • SSDEEP

    6144:wGPWPDwoEPePaPNOGCft2oSj3AO9dqj0AKrlIFHAuP6:w9D82CDQooSX9owAKrgH

Score
8/10

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\workwinScreen\Ӷ(Ա)\ⰲװɫ\WorkWintv.exe
    "C:\Users\Admin\AppData\Local\Temp\workwinScreen\Ӷ(Ա)\ⰲװɫ\WorkWintv.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2228
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:5268

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads