Overview

overview

3

Static

static

3

Potentiall...ed.exe

windows7-x64

1

Potentiall...ed.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    148s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03-05-2024 06:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PotentiallyUnwanted.exe

  • Size

    32KB

  • MD5

    1ac020d35be34d812d628af0a5bf29b1

  • SHA1

    8e0ab1e02e94700a153804585e59e30cb3dfb557

  • SHA256

    42d6581dd0a2ba9bec6a40c5b7c85870a8019d7347c9130d24752ec5865f0732

  • SHA512

    11fbeee6abce03faf07bc566ac770f471028bb2fbed2489ec4c276ec6826c79651b1b4071b4c2361dc5926f2b0bfe5add120c717b2109a87142c4f8b5cebd165

  • SSDEEP

    384:Tq5RHPNdu8uugaZoD0F9+rhQfdJkd/+vO2Dp/EDH6Nb0nuxw1mP+fXNGDvIrxJ:hN0FEheQohEDaNAnmEmANtrv

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PotentiallyUnwanted.exe
    "C:\Users\Admin\AppData\Local\Temp\PotentiallyUnwanted.exe"
    1⤵
      PID:2344
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
        PID:2108
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\EnableFind.mpe"
        1⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2676
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
        1⤵
          PID:2780

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2676-13-0x000007FEF5E60000-0x000007FEF5E94000-memory.dmp

          Filesize

          208KB

          Download

        • memory/2676-12-0x000000013FC30000-0x000000013FD28000-memory.dmp

          Filesize

          992KB

          Download

        • memory/2676-14-0x000007FEF5BA0000-0x000007FEF5E54000-memory.dmp

          Filesize

          2.7MB

          Download

        • memory/2676-15-0x000007FEF39F0000-0x000007FEF4A9B000-memory.dmp

          Filesize

          16.7MB

          Download