Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/06/2024, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
a05e8d3070769310677c365bc0dbce9b6fe552b2924849d4d521609f01a92d80.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a05e8d3070769310677c365bc0dbce9b6fe552b2924849d4d521609f01a92d80.exe
Resource
win10v2004-20240426-en
General
-
Target
a05e8d3070769310677c365bc0dbce9b6fe552b2924849d4d521609f01a92d80.exe
-
Size
2.0MB
-
MD5
d16c67d543138afb5d2d883aaaabc876
-
SHA1
eda8fa46ac35374f2368d3ddcae62263db15ddce
-
SHA256
a05e8d3070769310677c365bc0dbce9b6fe552b2924849d4d521609f01a92d80
-
SHA512
4e2f8118aa8e5a102ffea3f55451ac95d631a2f8d5d1c7608538bd36df89bdddcd5f6a06f03663105c68e910357c1c71a241208768c76e1fd87c92a5e11cff23
-
SSDEEP
49152:1G+RMTAN8vDn7ngHggQntjtiq5Tt2k3mcqbwahS6NwRU:1EANunTgHglnK6Tt2kW/ho7R
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2032 a05e8d3070769310677c365bc0dbce9b6fe552b2924849d4d521609f01a92d80.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2032 a05e8d3070769310677c365bc0dbce9b6fe552b2924849d4d521609f01a92d80.exe 2032 a05e8d3070769310677c365bc0dbce9b6fe552b2924849d4d521609f01a92d80.exe 2032 a05e8d3070769310677c365bc0dbce9b6fe552b2924849d4d521609f01a92d80.exe 2032 a05e8d3070769310677c365bc0dbce9b6fe552b2924849d4d521609f01a92d80.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2032 a05e8d3070769310677c365bc0dbce9b6fe552b2924849d4d521609f01a92d80.exe 2032 a05e8d3070769310677c365bc0dbce9b6fe552b2924849d4d521609f01a92d80.exe 2032 a05e8d3070769310677c365bc0dbce9b6fe552b2924849d4d521609f01a92d80.exe 2032 a05e8d3070769310677c365bc0dbce9b6fe552b2924849d4d521609f01a92d80.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a05e8d3070769310677c365bc0dbce9b6fe552b2924849d4d521609f01a92d80.exe"C:\Users\Admin\AppData\Local\Temp\a05e8d3070769310677c365bc0dbce9b6fe552b2924849d4d521609f01a92d80.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2032