c392c14304399e9ad13ede370375ecffa47f30245cb91a413a3fd1150721a929 | Triage

Analysis

max time kernel
230s
max time network
307s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 13:52

Sharing

Report Analysis Logs

General

Target

wininit (1).exe
Size

1.3MB
MD5

6b7314e8a04ad8436c3aff06f3918ea6
SHA1

61c5aca05c76396e70054b732d9afb7d4a5e293d
SHA256

c392c14304399e9ad13ede370375ecffa47f30245cb91a413a3fd1150721a929
SHA512

00b5c837c36cb44d5b1a7c724746daf85b4a1d4b89d55a2d81e8999ed34035baa84a8f9fc976704ec92afe52a316c09eb7b7d012d66d8d5eea284d31d5974baf
SSDEEP

24576:LAHnh+eWsN3skA4RV1Hom2KXMmHaUCTOhtduicYukHxavC55:mh+ZkldoPK8YaUC6h/qg

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

wininit (1).exe

pid process

4896 wininit (1).exe
4896 wininit (1).exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

wininit (1).exe

pid process

4896 wininit (1).exe
4896 wininit (1).exe

C:\Users\Admin\AppData\Local\Temp\wininit (1).exe
"C:\Users\Admin\AppData\Local\Temp\wininit (1).exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:4404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4896-10-0x0000000002600000-0x0000000002604000-memory.dmp

Filesize
16KB

Download