Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 05:07
Static task
static1
Behavioral task
behavioral1
Sample
dce5b8ea5b08707e180ecd36b629204f681516eaec7bfdc21a9aa4552e01d5d0.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
dce5b8ea5b08707e180ecd36b629204f681516eaec7bfdc21a9aa4552e01d5d0.exe
Resource
win10v2004-20240508-en
General
-
Target
dce5b8ea5b08707e180ecd36b629204f681516eaec7bfdc21a9aa4552e01d5d0.exe
-
Size
1.2MB
-
MD5
0df53fc9ca992eff7cd717044aff1b8c
-
SHA1
efbd46c26a083415ce15e1dfee4f868679461ec6
-
SHA256
dce5b8ea5b08707e180ecd36b629204f681516eaec7bfdc21a9aa4552e01d5d0
-
SHA512
2a87173c1ac2d5186c58a438f3552a08ec5ab2ed4c5357168c30b7798cb307bee55b411a2c30c5027f21b4884c879f6d03e892ae5968e5d56887e7711bd37086
-
SSDEEP
24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8aqaKP6cBDjvi/2HtjSu1A:ZTvC/MTQYxsWR7aqam6cBDjq/0jb1
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2040 dce5b8ea5b08707e180ecd36b629204f681516eaec7bfdc21a9aa4552e01d5d0.exe 2040 dce5b8ea5b08707e180ecd36b629204f681516eaec7bfdc21a9aa4552e01d5d0.exe 2040 dce5b8ea5b08707e180ecd36b629204f681516eaec7bfdc21a9aa4552e01d5d0.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2040 dce5b8ea5b08707e180ecd36b629204f681516eaec7bfdc21a9aa4552e01d5d0.exe 2040 dce5b8ea5b08707e180ecd36b629204f681516eaec7bfdc21a9aa4552e01d5d0.exe 2040 dce5b8ea5b08707e180ecd36b629204f681516eaec7bfdc21a9aa4552e01d5d0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dce5b8ea5b08707e180ecd36b629204f681516eaec7bfdc21a9aa4552e01d5d0.exe"C:\Users\Admin\AppData\Local\Temp\dce5b8ea5b08707e180ecd36b629204f681516eaec7bfdc21a9aa4552e01d5d0.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2040