Analysis
-
max time kernel
141s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
14/03/2024, 04:09
General
-
Target
客户端工具/ClientMgr.exe
-
Size
2.3MB
-
MD5
b1c8b57f0e91beadc469d33402356214
-
SHA1
84551580a86511a1ce8d4fbe788f3400a3534126
-
SHA256
0bdfcdcc853dbe3ce8d17c63b5484ca40ca2eb7501e547f705e7be7f248b4ebe
-
SHA512
3f2d8f4e102a3916643ed088edf97e4106bb64ccde66754c6d7f52fd89abadf9d2ccc43da33e2bedd9e2d15c2e31404c37dd91ec66303fa41900adcf9a5061a9
-
SSDEEP
49152:zljq3t7AWyFUZql49J2h6h3d+GYDWPt/KEieWrIipH/TYM8nf0F2t:xjAUFbKEhcQiiHeAIiF/0Mofw2
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\客户端工具\ClientMgr.exe"C:\Users\Admin\AppData\Local\Temp\客户端工具\ClientMgr.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4KB
-
Filesize
11.3MB
-
Filesize
4.0MB
-
Filesize
4KB