5c8dbf03a1f45997b2e786379007835b15804920bd6ae064faf94f3861737bb0 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 19:23

Sharing

Report Analysis Logs

General

Target

ayprivoxy.exe
Size

362KB
MD5

9b416fac618fb017deaef396e256b210
SHA1

ef0866b891ff18a230d9ea7c60197fa952991939
SHA256

0b3aa7e9e6b654463c37a80f0d68354f2a8a0e75e989ec3f55d85df4f2477bfb
SHA512

be19d0563c8d74c70a5014540a744bfa023c00db9c25ada8231d436029690e9624ce000a94011b11bc330565340eb52e94f5cd6ad950afe6ec30a8b1560089de
SSDEEP

6144:/UMDzXGbJcQQVqHCkeXGHqprBOb4CJn7CptLKC8dr08HweyrM4F16:/U+X1F8CPGHqprBOb/R48HweyrM4F16

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

ayprivoxy.exe

pid	Process
2932	ayprivoxy.exe

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

ayprivoxy.exe

pid	Process
2932	ayprivoxy.exe

C:\Users\Admin\AppData\Local\Temp\ayprivoxy.exe
"C:\Users\Admin\AppData\Local\Temp\ayprivoxy.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2932-1-0x0000000064B00000-0x0000000064B1A000-memory.dmp

Filesize
104KB

Download
memory/2932-0-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download