Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20-07-2024 16:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
132331.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
General
-
Target
132331.exe
-
Size
436KB
-
MD5
5e9a265fd95d899a93c8892638792c42
-
SHA1
4ba0fc8e0e8cf8a1d96babd59d69380ab31d337b
-
SHA256
b3c0767260b360a738683e33446860d2f494b21b2158e31c8c90ebc4b3e43bee
-
SHA512
b9d4129bf718bd6511f18fda1cc2aa40be94e5d1e3ae14ca4560dd230b6e034f6ff0d6dc84a6e5b540d6bc8ba7504d0f451c54327bd23ccbc02b0c35531ab120
-
SSDEEP
12288:7MSU4joci8M6PW1GVFeFd60DFUyhehYM:ASUCpM2W1Gvgmyehv
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\132331.exe" 132331.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\userini = "C:\\Users\\Admin\\AppData\\Local\\Temp\\132331.exe" 132331.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe 2536 132331.exe