bb1f02fca0445fd4759c6489fbebaa91095442f889649bb7abf7b098d64447d8 | Triage

Analysis

max time kernel
16s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:20

Sharing

Report Analysis Logs

General

Target

vmware.exe
Size

1.0MB
MD5

1bc084ca36096584eb8d05b44449093e
SHA1

217087892fc8c49ceb2510d9e208162170010733
SHA256

bb1f02fca0445fd4759c6489fbebaa91095442f889649bb7abf7b098d64447d8
SHA512

b025bd488bc7b6fda47d7e3a06bce171d1ee920058b0aa614443681870b8fc151045f2632e570eaf9fe71153cb365db7287a8ddf6117171bb53c602a512872cf
SSDEEP

24576:QrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvaaoE/Q:Q2EYTb8atv1orq+pEiSDTj1VyvBaan

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

vmware.exe

pid process

4856 vmware.exe
4856 vmware.exe
4856 vmware.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

vmware.exe

pid process

4856 vmware.exe
4856 vmware.exe
4856 vmware.exe

C:\Users\Admin\AppData\Local\Temp\vmware.exe
"C:\Users\Admin\AppData\Local\Temp\vmware.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads