Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 14:36
Static task
static1
Behavioral task
behavioral1
Sample
683557b0b0de9ff6f461c29241f7aedca31fa7a3d19e7997e150dad4fd708073.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
683557b0b0de9ff6f461c29241f7aedca31fa7a3d19e7997e150dad4fd708073.exe
Resource
win10v2004-20240426-en
General
-
Target
683557b0b0de9ff6f461c29241f7aedca31fa7a3d19e7997e150dad4fd708073.exe
-
Size
5.7MB
-
MD5
9bb3207279960ff22efa8de7ee2baf48
-
SHA1
1ee4e546eb13d15891dd408b95e7b95c4600e2ab
-
SHA256
683557b0b0de9ff6f461c29241f7aedca31fa7a3d19e7997e150dad4fd708073
-
SHA512
cdff330ca66f3727e464a07319989d02992bbf02813e7524326ef5ea8da53e6cd70a14eecb9cf28744172b7ae528df0013942206ab3f7e8a192d587352507058
-
SSDEEP
98304:b/6n94bDY2EBcBuq62V///4nAWakrn7S/IhWoaVVfs/VIsMF4JD8iulhq7NmlkVK:uMD+cpvJ/4H3nmghWoa/fsysMF4JD85J
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
683557b0b0de9ff6f461c29241f7aedca31fa7a3d19e7997e150dad4fd708073.exepid process 3856 683557b0b0de9ff6f461c29241f7aedca31fa7a3d19e7997e150dad4fd708073.exe 3856 683557b0b0de9ff6f461c29241f7aedca31fa7a3d19e7997e150dad4fd708073.exe 3856 683557b0b0de9ff6f461c29241f7aedca31fa7a3d19e7997e150dad4fd708073.exe 3856 683557b0b0de9ff6f461c29241f7aedca31fa7a3d19e7997e150dad4fd708073.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
683557b0b0de9ff6f461c29241f7aedca31fa7a3d19e7997e150dad4fd708073.exepid process 3856 683557b0b0de9ff6f461c29241f7aedca31fa7a3d19e7997e150dad4fd708073.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
683557b0b0de9ff6f461c29241f7aedca31fa7a3d19e7997e150dad4fd708073.exepid process 3856 683557b0b0de9ff6f461c29241f7aedca31fa7a3d19e7997e150dad4fd708073.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\683557b0b0de9ff6f461c29241f7aedca31fa7a3d19e7997e150dad4fd708073.exe"C:\Users\Admin\AppData\Local\Temp\683557b0b0de9ff6f461c29241f7aedca31fa7a3d19e7997e150dad4fd708073.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3856
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
652B
MD5e18017f47ce28f3eb7d82f4134b1b2af
SHA15e7f8298d78e217c1e200e6dfd9ec432d3ee3e6d
SHA25632a73c74e2aa99fd592741063a6087a7c76e9c8cc080ac0dd2ed167c3dc46e6d
SHA5124666075b78a2bfd6e64e169c37fe1cc56f39097aaef18d3f2ff6a808d5ade122ee8b786b8737929ef68fc1d5089a97498a91afdd27c4d9b8a7e3a72771bb82b4
-
Filesize
6KB
MD58db6d2ae0804e7f2571d05b2ee31a4ff
SHA12c6eceadaa37edf784f2066c7bc22d76d26b8664
SHA256a8bc147f3547d805cc0ca10e12cf57a6cd67749218c25ece257d244cd52428bc
SHA5123c0a5b6508a1e74e7b7048e0df04d82ea8ae489ab3964f31729f71ec508dbbea682eb795770b789f349d9c1ef8676059dbbda56f5f24b6509ba7471bbc55e627
-
Filesize
310B
MD57eff6668dead69c67b6f6ef7d14c2826
SHA12ef7ad54595d94881f9cfddf671f3756efc92aca
SHA256594b88480188f352b942f5650bb24a54765f34a5d93315b040248d4a9869a9a0
SHA5122c65e585c2f96391579fb962cd64a472c930d55f508af44003d488e0cb4ae357c51f1ce2c8432a05e13bede1f7ec17ae0b3c9650ce95a85e3b7c8b67c0f1b109