Overview

overview

8

Static

static

8

Hybackup6.0.0.exe

windows7-x64

1

Hybackup6.0.0.exe

windows10-2004-x64

1

hyhelp/howdo.htm

windows7-x64

1

hyhelp/howdo.htm

windows10-2004-x64

1

hyhelp/postbuy.doc

windows7-x64

4

hyhelp/postbuy.doc

windows10-2004-x64

1

我们的主页.url

windows7-x64

1

我们的主页.url

windows10-2004-x64

1

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-03-2024 06:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Hybackup6.0.0.exe

  • Size

    583KB

  • MD5

    ab365d597740145bb4fbc60c94081eed

  • SHA1

    286cc6439c3b2466e11af3e53e1fcffee31b25a6

  • SHA256

    0b5dda83cad70307939068e4b4d7725ecd4b397c260f1517ed38e5b48b4c2a87

  • SHA512

    1afd4b17233274a0818a981f72a2a2eba4fbdf127eb33a56f16a6bf83ec6b387bd5d32e6c91e49bfeb14337dab7bf182365facdec2303b8e138a09d728ebdfea

  • SSDEEP

    12288:VixrrkcVZ8COKFLJMwrET78w/LC4bZFCGvWcYAsDHdK79ydnxy:VQf9TJOnG4zCpssLYyvy

Score
1/10

Malware Config

Signatures

  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Hybackup6.0.0.exe
    "C:\Users\Admin\AppData\Local\Temp\Hybackup6.0.0.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/388-0-0x00000000008B0000-0x00000000008B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/388-1-0x0000000000400000-0x00000000005B4000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/388-8-0x0000000000400000-0x00000000005B4000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/388-9-0x00000000008B0000-0x00000000008B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/388-10-0x0000000000400000-0x00000000005B4000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/388-11-0x0000000000400000-0x00000000005B4000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/388-12-0x0000000000400000-0x00000000005B4000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/388-13-0x0000000000400000-0x00000000005B4000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/388-14-0x0000000000400000-0x00000000005B4000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/388-15-0x0000000000400000-0x00000000005B4000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/388-16-0x0000000000400000-0x00000000005B4000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/388-17-0x0000000000400000-0x00000000005B4000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/388-18-0x0000000000400000-0x00000000005B4000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/388-19-0x0000000000400000-0x00000000005B4000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/388-20-0x0000000000400000-0x00000000005B4000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/388-21-0x0000000000400000-0x00000000005B4000-memory.dmp
    Filesize

    1.7MB

    Download