Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 06:38
Behavioral task
behavioral1
Sample
Device/HarddiskVolume3/FN-Progs/crtbartcomfile.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Device/HarddiskVolume3/FN-Progs/crtbartcomfile.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Device/HarddiskVolume3/FN-Progs/crtbartcomfile.exe
-
Size
354KB
-
MD5
9ed5cc7274ed3587662f0e5ee54b0918
-
SHA1
53226274793e51103008da5096762854a4d25935
-
SHA256
31342c104c6a0af752634ce13603b1a46da27e0ddca9e86cbe5b6105de4c3d55
-
SHA512
5bc54bd6a9773d4ba75f64ee18504abe40c009d1ac2f66bf4a1084df2ea4bfea29304e389bbcec1e27e36e4a8a82e4c5ed739c13056693a32bf0132ad601159b
-
SSDEEP
6144:ElZ/zUMu4pDSxsCMRzf7x3SfS1JAzXBtL76lLIWRiX2h/JTaUgQO:EHLUMuiv9RgfSjAzRtyrMX2hBGt
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4784-0-0x0000000000400000-0x00000000004B8000-memory.dmp upx behavioral2/memory/4784-4-0x0000000000400000-0x00000000004B8000-memory.dmp upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4784-4-0x0000000000400000-0x00000000004B8000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4784 crtbartcomfile.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe 4784 crtbartcomfile.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4784 wrote to memory of 880 4784 crtbartcomfile.exe 86 PID 4784 wrote to memory of 880 4784 crtbartcomfile.exe 86 PID 4784 wrote to memory of 880 4784 crtbartcomfile.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume3\FN-Progs\crtbartcomfile.exe"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume3\FN-Progs\crtbartcomfile.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\Notepad.exeNotepad.exe2⤵PID:880
-