Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/03/2024, 11:37
Behavioral task
behavioral1
Sample
cdf792807736f42b4fd634932755e519.exe
Resource
win7-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
cdf792807736f42b4fd634932755e519.exe
Resource
win10v2004-20240226-en
5 signatures
150 seconds
General
-
Target
cdf792807736f42b4fd634932755e519.exe
-
Size
712KB
-
MD5
cdf792807736f42b4fd634932755e519
-
SHA1
e3c7bd05ea648cbf2223675a7c955e18dd791d1b
-
SHA256
2cc0c09f7f04b81c058ec49f7dbbfa8e31f0d96f671938ba684784ba35aaaf49
-
SHA512
7ee89272032e1874fcd75ca389c14efcf5d3c53f04f9f57ab978bb8fd1da08a0b4adbf8a361efe4f1804db9d7cc73f73b07f4f6352744c4268e1db00dcc295c7
-
SSDEEP
12288:taAwLhZ8yR7aUrwLciq/J2eFy3xS3TAT8grTb2PrvblX90bjTLuXtw3oFEsn1uI:tA8JGwc//03qATzTqP1NILbo1u
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2852-0-0x0000000000400000-0x00000000005E8000-memory.dmp vmprotect behavioral1/memory/2852-1-0x0000000000400000-0x00000000005E8000-memory.dmp vmprotect behavioral1/memory/2852-5-0x0000000000400000-0x00000000005E8000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2852 cdf792807736f42b4fd634932755e519.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2852 cdf792807736f42b4fd634932755e519.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2852 cdf792807736f42b4fd634932755e519.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2852 cdf792807736f42b4fd634932755e519.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdf792807736f42b4fd634932755e519.exe"C:\Users\Admin\AppData\Local\Temp\cdf792807736f42b4fd634932755e519.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2852