Resubmissions

31/05/2024, 15:07

240531-shr46scg46 8

31/05/2024, 15:06

240531-sg6aeacb5t 8

Analysis

  • max time kernel
    1794s
  • max time network
    1799s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 15:06

General

  • Target

    7+ Taskbar Tweaker.exe

  • Size

    482KB

  • MD5

    6da96b41736b77d8522d63a412ee5162

  • SHA1

    54f2c9c1a3526d451796682a8271c51ecccb83f2

  • SHA256

    fcdc7f3c907e111e50d9a82e76c4a142875a7e7a1c3b1d74fd9bf5a30e44d417

  • SHA512

    6dcc3c85b6c41d985c9b0b1b21a8a77b17d75a1c28b4f0f1d43e4b975572f6d9fb8b91358911e4887f4d29378664002ed0b004bc399330115fc90ed99f4f8464

  • SSDEEP

    6144:rI5iCHDGIZU3H3SQg39Tlg1ASntD0oqYSGmOCQXl3zVGHttt1:U5iCHPZU3XSQg39+1/aYSGjCcKNb1

Score
1/10

Malware Config

Signatures

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3524
    • C:\Users\Admin\AppData\Local\Temp\7+ Taskbar Tweaker.exe
      "C:\Users\Admin\AppData\Local\Temp\7+ Taskbar Tweaker.exe"
      2⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:608
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:8
    1⤵
      PID:5072
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4020,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
      1⤵
        PID:3152

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/3524-0-0x0000000001000000-0x0000000001001000-memory.dmp

              Filesize

              4KB

            • memory/3524-1-0x0000000001000000-0x0000000001001000-memory.dmp

              Filesize

              4KB

            • memory/3524-2-0x0000000001000000-0x0000000001001000-memory.dmp

              Filesize

              4KB

            • memory/3524-4-0x00007FF732070000-0x00007FF732071000-memory.dmp

              Filesize

              4KB

            • memory/3524-5-0x00007FFEA3790000-0x00007FFEA3791000-memory.dmp

              Filesize

              4KB

            • memory/3524-7-0x0000000001000000-0x0000000001001000-memory.dmp

              Filesize

              4KB

            • memory/3524-8-0x00007FF732070000-0x00007FF732071000-memory.dmp

              Filesize

              4KB