Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
12-06-2024 04:33
General
-
Target
YXCalendar.exe
-
Size
8.7MB
-
MD5
18418c7f12becb03f65121f37f50c284
-
SHA1
fbb2bd6f4494dc9e8798c0e2209de2967af69f80
-
SHA256
7b59ce0108b3474df9c3282afee1cfc41e0e572d5cf7b2cb72c3cc64ce77bd7b
-
SHA512
d546d4df4055c163aa2592423b92b82275e2a144cd713d1be513e02893cf223b216da6ef9a473acaaff3a2f01ff4f75780b484ae25403b9cc5fc51f4895a12b1
-
SSDEEP
196608:jIwzaWxdeNctICkmDcoPTDZ/tTpIhFeXawoE0D+JMvd:jIwHxd9tDcoHZ1wKS
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 17 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\YXCalendar.exe"C:\Users\Admin\AppData\Local\Temp\YXCalendar.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage