Analysis
-
max time kernel
66s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 15:17
Static task
static1
Behavioral task
behavioral1
Sample
3a239b4017c1e223465804a8b487f2172f7749b0c7db27c24b796b7a83922dfa.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3a239b4017c1e223465804a8b487f2172f7749b0c7db27c24b796b7a83922dfa.exe
Resource
win10v2004-20240419-en
General
-
Target
3a239b4017c1e223465804a8b487f2172f7749b0c7db27c24b796b7a83922dfa.exe
-
Size
2.6MB
-
MD5
2421ae44f9f9d69641db83c4c338e47c
-
SHA1
1bf1782cb3eda211897f7138c0bc355521f24641
-
SHA256
3a239b4017c1e223465804a8b487f2172f7749b0c7db27c24b796b7a83922dfa
-
SHA512
524878f1696a613b3a35e55cc1b2bf08ed0b7119191ad340b351a548fa0c814d33ee690289f6c070e8a34b32f0aa3e8261b73412ae6438115610ce735febc1f9
-
SSDEEP
49152:BcwuJBa4qtNLVx0KRwI0P4DCmDi8GQKxxzYKTs7Dqn8GAcwxmcpJKh:/uJBa4qX0TQDCmDi8GLTzLTs7DhGAtm
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1524 3a239b4017c1e223465804a8b487f2172f7749b0c7db27c24b796b7a83922dfa.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1524 3a239b4017c1e223465804a8b487f2172f7749b0c7db27c24b796b7a83922dfa.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1524 3a239b4017c1e223465804a8b487f2172f7749b0c7db27c24b796b7a83922dfa.exe 1524 3a239b4017c1e223465804a8b487f2172f7749b0c7db27c24b796b7a83922dfa.exe 1524 3a239b4017c1e223465804a8b487f2172f7749b0c7db27c24b796b7a83922dfa.exe 1524 3a239b4017c1e223465804a8b487f2172f7749b0c7db27c24b796b7a83922dfa.exe 1524 3a239b4017c1e223465804a8b487f2172f7749b0c7db27c24b796b7a83922dfa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a239b4017c1e223465804a8b487f2172f7749b0c7db27c24b796b7a83922dfa.exe"C:\Users\Admin\AppData\Local\Temp\3a239b4017c1e223465804a8b487f2172f7749b0c7db27c24b796b7a83922dfa.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1524