Analysis
-
max time kernel
140s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 14:38
Behavioral task
behavioral1
Sample
c989206d13f0fef56a5bcb4822958af48e8b4a1606c2b5acafd519c460aee072.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c989206d13f0fef56a5bcb4822958af48e8b4a1606c2b5acafd519c460aee072.exe
Resource
win10v2004-20240508-en
General
-
Target
c989206d13f0fef56a5bcb4822958af48e8b4a1606c2b5acafd519c460aee072.exe
-
Size
1.9MB
-
MD5
da579bc5f7475e0cf03c9a3c1efd60d0
-
SHA1
2a42a4ad7277ddbfc4836b5207cf61c46cda9738
-
SHA256
c989206d13f0fef56a5bcb4822958af48e8b4a1606c2b5acafd519c460aee072
-
SHA512
f6876532892b9ff948b436809e39cb5e56a13f254a302bf5acf6c5f2c64c57d18f09d6d261282061bfd50a0f9a2fd623365bd6474e5f76177f32322c5c85b25b
-
SSDEEP
24576:pDj2qCTcORo5LzKtG1bO+wbT6U5oT/HV2f1UV8///CbUm7XRQV7bJOy44go8PeW6:p/2lcMxEfBTHY1B//k7X+V7bwyPoHXi
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1964-0-0x0000000000400000-0x00000000009FB000-memory.dmp upx behavioral1/memory/1964-11-0x0000000000400000-0x00000000009FB000-memory.dmp upx behavioral1/memory/1964-13-0x0000000000400000-0x00000000009FB000-memory.dmp upx behavioral1/memory/1964-34-0x0000000000400000-0x00000000009FB000-memory.dmp upx behavioral1/memory/1964-35-0x0000000000400000-0x00000000009FB000-memory.dmp upx behavioral1/memory/1964-36-0x0000000000400000-0x00000000009FB000-memory.dmp upx behavioral1/memory/1964-37-0x0000000000400000-0x00000000009FB000-memory.dmp upx behavioral1/memory/1964-38-0x0000000000400000-0x00000000009FB000-memory.dmp upx behavioral1/memory/1964-39-0x0000000000400000-0x00000000009FB000-memory.dmp upx behavioral1/memory/1964-40-0x0000000000400000-0x00000000009FB000-memory.dmp upx behavioral1/memory/1964-41-0x0000000000400000-0x00000000009FB000-memory.dmp upx behavioral1/memory/1964-42-0x0000000000400000-0x00000000009FB000-memory.dmp upx behavioral1/memory/1964-43-0x0000000000400000-0x00000000009FB000-memory.dmp upx -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main c989206d13f0fef56a5bcb4822958af48e8b4a1606c2b5acafd519c460aee072.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1964 c989206d13f0fef56a5bcb4822958af48e8b4a1606c2b5acafd519c460aee072.exe 1964 c989206d13f0fef56a5bcb4822958af48e8b4a1606c2b5acafd519c460aee072.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1964 c989206d13f0fef56a5bcb4822958af48e8b4a1606c2b5acafd519c460aee072.exe 1964 c989206d13f0fef56a5bcb4822958af48e8b4a1606c2b5acafd519c460aee072.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1964 c989206d13f0fef56a5bcb4822958af48e8b4a1606c2b5acafd519c460aee072.exe 1964 c989206d13f0fef56a5bcb4822958af48e8b4a1606c2b5acafd519c460aee072.exe 1964 c989206d13f0fef56a5bcb4822958af48e8b4a1606c2b5acafd519c460aee072.exe 1964 c989206d13f0fef56a5bcb4822958af48e8b4a1606c2b5acafd519c460aee072.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c989206d13f0fef56a5bcb4822958af48e8b4a1606c2b5acafd519c460aee072.exe"C:\Users\Admin\AppData\Local\Temp\c989206d13f0fef56a5bcb4822958af48e8b4a1606c2b5acafd519c460aee072.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1964