Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 04:04
Static task
static1
Behavioral task
behavioral1
Sample
77b8da7f400ab3aaf3fb1e4dc0db9c78b145e03fb9b61a72371089d05c723840.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
77b8da7f400ab3aaf3fb1e4dc0db9c78b145e03fb9b61a72371089d05c723840.exe
Resource
win10v2004-20240508-en
General
-
Target
77b8da7f400ab3aaf3fb1e4dc0db9c78b145e03fb9b61a72371089d05c723840.exe
-
Size
5.7MB
-
MD5
0af5165e5181e296fed07084579d34a1
-
SHA1
e084112366260762edcea7bf00c27f4ec33490f8
-
SHA256
77b8da7f400ab3aaf3fb1e4dc0db9c78b145e03fb9b61a72371089d05c723840
-
SHA512
68c7c18457069dee2b8def08d16c5c84a4e6c468ac4da26cb03b6dad7dad7ad68aac88d99be6ead8593cded50bf929fa67476aa2e33f2bbb4fbd70685054d177
-
SSDEEP
98304:j/6n94bDY2EBcBuq62V///4nAWakrn7S/IhWoaVVfs/VIsMF4JD8iulhq7NmXkV3:mMD+cpvJ/4H3nmghWoa/fsysMF4JD854
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
77b8da7f400ab3aaf3fb1e4dc0db9c78b145e03fb9b61a72371089d05c723840.exepid process 5052 77b8da7f400ab3aaf3fb1e4dc0db9c78b145e03fb9b61a72371089d05c723840.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
77b8da7f400ab3aaf3fb1e4dc0db9c78b145e03fb9b61a72371089d05c723840.exepid process 5052 77b8da7f400ab3aaf3fb1e4dc0db9c78b145e03fb9b61a72371089d05c723840.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77b8da7f400ab3aaf3fb1e4dc0db9c78b145e03fb9b61a72371089d05c723840.exe"C:\Users\Admin\AppData\Local\Temp\77b8da7f400ab3aaf3fb1e4dc0db9c78b145e03fb9b61a72371089d05c723840.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5052
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\yjs_log\log.logFilesize
650B
MD5602acc719d7de995ce22d35dc31d2ab6
SHA12ca494955a283246f384a429022fbfb3ba668424
SHA256f6c52bba5c58a80c890bb54899d93e3a2872206b2efc8ba461e34647416d226c
SHA51237f9b992ea8021eb8079398f6ea2b801844d27087a1411006b85422a8d075bbc05e498d96051d1fce8c2ab13d915a5fa1c7bb0884ee5af12bf9fc8778a982b10
-
C:\Users\Admin\AppData\Local\Temp\yjs_log\log.logFilesize
1KB
MD5351896064bb781a979aebe1883a37174
SHA1788af8b1be26c6ad4d482cead991bebd722744ca
SHA256150c6af9b9b06957fc621a5c011979281a7d51d4f0e711440b49e4d3ca2dc2fa
SHA512cd21a8f63a2581ff602c8d65918887d05a7a80c1c5c2a677f21536e54b52fb001fc1e5eb92d772c0d356489b5720f2315e363c92f7e25a7b0f4369e9b92dac43
-
C:\Users\Admin\AppData\Local\Temp\yjs_log\log.logFilesize
308B
MD51d295979a28a43be71b76ef179b23448
SHA1caf8105c82c78c7a33cb32f8550c5d6e6f7d4a25
SHA256660ec462b0516301d8f9f468af97c7224cd25e42b2c63c9f84d3f1823ffc8f28
SHA512778aaa94827738cbf6dd2ccd4d5b433ca8527ff877ae525c5d16b2419f05b504cbdfc9e51e3e9bbab4b48ab5a2523aab0b048a9d50dd7f33cb69698955707462