Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 02:20
Static task
static1
Behavioral task
behavioral1
Sample
9dec09d9fece732acb1a2bef06325d6ff7e339a45a6409146a5ac5698a588ccc.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
9dec09d9fece732acb1a2bef06325d6ff7e339a45a6409146a5ac5698a588ccc.exe
Resource
win10v2004-20240709-en
General
-
Target
9dec09d9fece732acb1a2bef06325d6ff7e339a45a6409146a5ac5698a588ccc.exe
-
Size
1.9MB
-
MD5
31a92335ffee39117f0fa195cfc18d14
-
SHA1
92ee45456bb3a4d742964614792506558304f16a
-
SHA256
9dec09d9fece732acb1a2bef06325d6ff7e339a45a6409146a5ac5698a588ccc
-
SHA512
4a19f7e957c634d4768ea0049e61ec7533638c089f40b2ae4536ab16158715920e755d382508ca4af60e0668edfb6b4542c16ce1833c5561af7720ccda0d32ea
-
SSDEEP
49152:rt1uijgifSWHh5NOPpWJtqHRGnmKkd7tycDlp/F4:R9Nf7BSx+YgmZVhm
Malware Config
Signatures
-
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\WanNengWBInput\9.8.8.0112\WanNengWBInfo.ini 9dec09d9fece732acb1a2bef06325d6ff7e339a45a6409146a5ac5698a588ccc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2552 9dec09d9fece732acb1a2bef06325d6ff7e339a45a6409146a5ac5698a588ccc.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2552 9dec09d9fece732acb1a2bef06325d6ff7e339a45a6409146a5ac5698a588ccc.exe 2552 9dec09d9fece732acb1a2bef06325d6ff7e339a45a6409146a5ac5698a588ccc.exe 2552 9dec09d9fece732acb1a2bef06325d6ff7e339a45a6409146a5ac5698a588ccc.exe 2552 9dec09d9fece732acb1a2bef06325d6ff7e339a45a6409146a5ac5698a588ccc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2552 9dec09d9fece732acb1a2bef06325d6ff7e339a45a6409146a5ac5698a588ccc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dec09d9fece732acb1a2bef06325d6ff7e339a45a6409146a5ac5698a588ccc.exe"C:\Users\Admin\AppData\Local\Temp\9dec09d9fece732acb1a2bef06325d6ff7e339a45a6409146a5ac5698a588ccc.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2552