Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 05:06
Static task
static1
Behavioral task
behavioral1
Sample
6cd49a50f765d9bf4c0ed9b3577c9715d583d47399f830bee5bb97d7ec14df47.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6cd49a50f765d9bf4c0ed9b3577c9715d583d47399f830bee5bb97d7ec14df47.exe
Resource
win10v2004-20240508-en
General
-
Target
6cd49a50f765d9bf4c0ed9b3577c9715d583d47399f830bee5bb97d7ec14df47.exe
-
Size
5.7MB
-
MD5
06e39a7ec57c77acbc82f57e10dc274e
-
SHA1
24fa6de43c634c9a9c7fd1ee5462ceab47fd23cd
-
SHA256
6cd49a50f765d9bf4c0ed9b3577c9715d583d47399f830bee5bb97d7ec14df47
-
SHA512
44cdaf3fd7fe8e886473fa431218891822cb918d13d9bdd279657a86db38a6de7501bf80ed5021a1ee833aecd114af3e47ce1d653caff10ecf99af503b11d709
-
SSDEEP
98304:b/6n94bDY2EBcBuq62V///4nAWakrn7S/IhWoaVVfs/VIsMF4JD8iulhq7NmKkVW:uMD+cpvJ/4H3nmghWoa/fsysMF4JD858
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
6cd49a50f765d9bf4c0ed9b3577c9715d583d47399f830bee5bb97d7ec14df47.exepid process 2836 6cd49a50f765d9bf4c0ed9b3577c9715d583d47399f830bee5bb97d7ec14df47.exe 2836 6cd49a50f765d9bf4c0ed9b3577c9715d583d47399f830bee5bb97d7ec14df47.exe 2836 6cd49a50f765d9bf4c0ed9b3577c9715d583d47399f830bee5bb97d7ec14df47.exe 2836 6cd49a50f765d9bf4c0ed9b3577c9715d583d47399f830bee5bb97d7ec14df47.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
6cd49a50f765d9bf4c0ed9b3577c9715d583d47399f830bee5bb97d7ec14df47.exepid process 2836 6cd49a50f765d9bf4c0ed9b3577c9715d583d47399f830bee5bb97d7ec14df47.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
6cd49a50f765d9bf4c0ed9b3577c9715d583d47399f830bee5bb97d7ec14df47.exepid process 2836 6cd49a50f765d9bf4c0ed9b3577c9715d583d47399f830bee5bb97d7ec14df47.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cd49a50f765d9bf4c0ed9b3577c9715d583d47399f830bee5bb97d7ec14df47.exe"C:\Users\Admin\AppData\Local\Temp\6cd49a50f765d9bf4c0ed9b3577c9715d583d47399f830bee5bb97d7ec14df47.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\yjs_log\log.logFilesize
652B
MD58a913ad2386304cbf88bfb1082d49423
SHA13d3eaed9cf2c33ba5ccd11d8430880ee9ad76c7c
SHA2563c4c76309235f6cd8dd3bbc86b9517ed5805cb6ce38680e0dcb48f4fd883d1b2
SHA512f4cdc4cd285044f3c1489768526d4effa29a914fcc39ec98e767a29bfb07df3d317e828a45e3e02c8e8e7ee15f23ed0b8db7665e4a7401601a4d35b9938e3fa2
-
C:\Users\Admin\AppData\Local\Temp\yjs_log\log.logFilesize
310B
MD587afe641b89a073e7a1cab02f1b98b25
SHA12648cd2b5cf984b70d1368de7cd0eb8e66de9b19
SHA25684bbeabf8c888383ffaebd068d44ed94209886c2e72667fed4173df7f759efaf
SHA512bdec321438b59f04e36bdfe47f0ce0f8adde2a5b8dc35cc27f621644c989ae3710518d698d500e3ff46932710a79546b3519dc2802fa300b31bf11c5b27b9a73
-
C:\Users\Admin\AppData\Local\Temp\yjs_log\log.logFilesize
4KB
MD5287afa8a93b2b9f201ecb822dd8a0f7a
SHA1485d2417bacbf4512f99fc4548a7857618b6cc00
SHA256ee83d19ef7b82a284baeb2f8539360f1d14236122ec1ad599f3da891c0965b19
SHA512c281ad9931d70620402cddc00cdd73120281dd24e4d24e7175830e3e0b8f007c3734a581ec34cd68094b35324240909cb04c6874b4bd141fa643bfc4fcd4368a