Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
06-06-2024 23:58
Static task
static1
Behavioral task
behavioral1
Sample
42.zip
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
42.zip
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
42.zip
-
Size
41KB
-
MD5
1df9a18b18332f153918030b7b516615
-
SHA1
6c42c62696616b72bbfc88a4be4ead57aa7bc503
-
SHA256
bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa
-
SHA512
6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80
-
SSDEEP
768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2584 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2584 taskmgr.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\42.zip1⤵PID:1636
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2584
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2820