Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 16:27
Static task
static1
Behavioral task
behavioral1
Sample
23-FlsEngine.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
23-FlsEngine.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
core/23-FlsEngine-Easy-Core.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
core/23-FlsEngine-Easy-Core.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
必看使用说明.xls
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
必看使用说明.xls
Resource
win10v2004-20231215-en
General
-
Target
23-FlsEngine.exe
-
Size
7.9MB
-
MD5
1e7084396b0c0aa313074fa8ec07d878
-
SHA1
48ec08c4974365bc90152b0318b4bb69e8978e5b
-
SHA256
1ccae6c5e3c9ec827f6063eb7ccb9c204ec858d3677832ac50c094121d704d51
-
SHA512
e0971842412f9091a25b49d241eefafeb9b46e6909ef6589536406afb17939ba0727028ff7c5bf7c4ca4eff3d39bb6284b3b162ccdc77864c1a09427df9f4175
-
SSDEEP
196608:w8PTIwnx2ROfHpRUgg0CZ4M8QdlVXqqJip7/vpA5I:w8P8oq0HpPCSM8QMbpA5
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3680 23-FlsEngine.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3680 23-FlsEngine.exe