3c72f2851f20fee1e57a73226a2d4a54d88f55fbcaa817bac22eaf01cb79c8de | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 08:55

Sharing

Report Analysis Logs

General

Target

Firewall.exe
Size

332KB
MD5

a9bae7ec6bc658f5f3f21763afcd852e
SHA1

04dafcbe2e16735df793e344f9466e3cc5e9d23c
SHA256

be9da8e57f2372c2e5fd4fae7b1c21f7d909c0e642d7abca6b566dd4a12e0231
SHA512

cc2549dfe7fd41410e8b79600aea10b7578ac55bd2071922346c9f08fc5fa2fd1891adcdaed30a104673e3a724462b4a0cb02755ad04dd676fce63c788ed7886
SSDEEP

6144:W8gNW3H/AW45Iz87Aqozzg/JUUEa8K41RZoEhLQfeXM:hgUX/AW45Toz2Uva8oEJQ2

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2880	Firewall.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2880	Firewall.exe

C:\Users\Admin\AppData\Local\Temp\Firewall.exe
"C:\Users\Admin\AppData\Local\Temp\Firewall.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2880-0-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/2880-1-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download