Analysis
- max time kernel
51s - max time network
58s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 04:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8471996102a039a0e3f9ade991b175cf92147f35c9e417224e557424b5b65096.exe
Resource
win7-20240611-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
8471996102a039a0e3f9ade991b175cf92147f35c9e417224e557424b5b65096.exe
Resource
win10v2004-20240508-en
3 signatures
150 seconds
General
- Target 8471996102a039a0e3f9ade991b175cf92147f35c9e417224e557424b5b65096.exe
- Size 5.7MB
- Sample240613-fkd9wavejf
- SHA256 8471996102a039a0e3f9ade991b175cf92147f35c9e417224e557424b5b65096
- MD5 f2b79f14e80481a09b9366c6ecacc56d
- SHA1 e7f280b2646cfa01b63ef92d12842dd1a15059e5
- SHA512 96ae193acf5b6813a203521862ab80c1bb703af4ea3dd88a206713ed15371f399a28b42918a016b0f7e9092f63807da9e861f86d11c48cd0773dd4973ece3fcb
- SSDEEP 98304:j/6n94bDY2EBcBuq62V///4nAWakrn7S/IhWoaVVfs/VIsMF4JD8iulhq7NmSkVN:mMD+cpvJ/4H3nmghWoa/fsysMF4JD85X
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1836 8471996102a039a0e3f9ade991b175cf92147f35c9e417224e557424b5b65096.exe 1836 8471996102a039a0e3f9ade991b175cf92147f35c9e417224e557424b5b65096.exe 1836 8471996102a039a0e3f9ade991b175cf92147f35c9e417224e557424b5b65096.exe 1836 8471996102a039a0e3f9ade991b175cf92147f35c9e417224e557424b5b65096.exe 1836 8471996102a039a0e3f9ade991b175cf92147f35c9e417224e557424b5b65096.exe 1836 8471996102a039a0e3f9ade991b175cf92147f35c9e417224e557424b5b65096.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1836 8471996102a039a0e3f9ade991b175cf92147f35c9e417224e557424b5b65096.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1836 8471996102a039a0e3f9ade991b175cf92147f35c9e417224e557424b5b65096.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8471996102a039a0e3f9ade991b175cf92147f35c9e417224e557424b5b65096.exe"C:\Users\Admin\AppData\Local\Temp\8471996102a039a0e3f9ade991b175cf92147f35c9e417224e557424b5b65096.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1836
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\yjs_log\log.log
- Size 584B
- SHA256 aa98158015297fd33ace8a4e8f95efbedff28b6bc992406af27c36c4367acaac
- MD5 009a3169a3ab481bea32561f798c421a
- SHA1 453a56f293548002108b939d5015f86240ca08e5
- SHA512 cc1aa5670e0a2ac5f113edab1aa3d73d502b438f34d25b7a0395c7dabf09179095196b7fba6feb03bed54990f1bfe328e61587c15322f02967c547dc94bf60de
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\yjs_log\log.log
- Size 4KB
- SHA256 e6f287dd05e0bd672c5068efe8fa0fa743bc94ebb53aa1f44262ec2198bc0d44
- MD5 ccd82c3f02ad700de067ef1c400ea014
- SHA1 36490041e54117a12ef8b3cc84f14772ab5fc9b1
- SHA512 e07ea144348f324cf2f45d57aac9ffa6d36c7d45e24e461cb37b502814d0319b8c7b0841d4f8579d396c256949819f783fe56d981a4cb53805f2328afee3bb94
- SSDEEP 96:bY1dhMLHcxA6gITqBIxH91M1r1y11r1+1W1D1E1R1K1Q1n111s1L1qSQ59R5gL5d:2dhvxAvexHxBm9R5W5v5E5F5C5p5B5c+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\yjs_log\log.log
- Size 315B
- SHA256 ec953e6134a4f63ac49dc7d42d163c750e4291b42138f7959693620942bbe6eb
- MD5 7b4a80f2db3d4c301dad14a6b44c2d32
- SHA1 455189432a9448387b837ae452f5d95a9f66e9ab
- SHA512 85eba3931cfa0b1f5fedfd81f2dba44e8bc1f99dbfe0436a011357d7094ef7233b5f9d5594055180dad68045cef3ed59d3c336c1725d5ef19c10e7c8d375e832
- MD5 SHA1 SHA512