Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:28
Behavioral task
behavioral1
Sample
c075f176b8b22e58f075616a4f8cdc8bda29190b9799b70a1ec072aee95d4c54.exe
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
c075f176b8b22e58f075616a4f8cdc8bda29190b9799b70a1ec072aee95d4c54.exe
-
Size
535KB
-
MD5
a9239e394b0d873e78af4d427adba27b
-
SHA1
29012f648fb42e7e532467a77a0b4f6a83404527
-
SHA256
c075f176b8b22e58f075616a4f8cdc8bda29190b9799b70a1ec072aee95d4c54
-
SHA512
64d32b342b2e39a66408df95b5df569dd900e4c5dbaea92db450220fb2cb09e1b1cf12d60e6e29faa2f9a82232261c7cc308bb2741e3471a784962ee6cc8859f
-
SSDEEP
12288:VYV6MorX7qzuC3QHO9FQVHPF51jgcxqLbJd3OwnBrhGlbL:KBXu9HGaVHYJ9XJGf
Score
7/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1704-0-0x0000000000E20000-0x0000000000F59000-memory.dmp upx behavioral1/memory/1704-12-0x0000000000E20000-0x0000000000F59000-memory.dmp upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1704-12-0x0000000000E20000-0x0000000000F59000-memory.dmp autoit_exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
c075f176b8b22e58f075616a4f8cdc8bda29190b9799b70a1ec072aee95d4c54.exepid process 1704 c075f176b8b22e58f075616a4f8cdc8bda29190b9799b70a1ec072aee95d4c54.exe 1704 c075f176b8b22e58f075616a4f8cdc8bda29190b9799b70a1ec072aee95d4c54.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
c075f176b8b22e58f075616a4f8cdc8bda29190b9799b70a1ec072aee95d4c54.exepid process 1704 c075f176b8b22e58f075616a4f8cdc8bda29190b9799b70a1ec072aee95d4c54.exe 1704 c075f176b8b22e58f075616a4f8cdc8bda29190b9799b70a1ec072aee95d4c54.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c075f176b8b22e58f075616a4f8cdc8bda29190b9799b70a1ec072aee95d4c54.exe"C:\Users\Admin\AppData\Local\Temp\c075f176b8b22e58f075616a4f8cdc8bda29190b9799b70a1ec072aee95d4c54.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage