Analysis
-
max time kernel
135s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
24-06-2024 12:13
General
-
Target
DesktopOverlayHostLoader.exe
-
Size
25KB
-
MD5
d9ff9504da8b627b720fe8f62f3bd24d
-
SHA1
636b35abd84344b437b24efadd175f2c8bbcb18c
-
SHA256
57dfce7a5cfe97578a45b35731a327e88b22fee0dbc4ec0b4dc1e919cc94e12f
-
SHA512
9510198e016a52da3d231ce4b8a0a1d55987454196a99bdfa998d25d530d4c46646f141ab13ee38a260c2a069a5d07d7d3110e450356b5bfe2be72e44f77d672
-
SSDEEP
384:0UvYJrPjoYTYNJVGzaC/uVGBkNl6bCIN6ki2ApxiRggivcV7Mp:0UvYtcYTYXVFWkNlTD2ApZL07Mp
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DesktopOverlayHostLoader.exe"C:\Users\Admin\AppData\Local\Temp\DesktopOverlayHostLoader.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DesktopOverlayHost.exe"C:\Users\Admin\AppData\Local\Temp\DesktopOverlayHost.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-