e4642f6ecf8e2fd74dab5f966f6e7cac8cb0435c15dbe24ce8ac7e96708ca550 | Triage

Analysis

max time kernel
135s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 02:13

Sharing

Report Analysis Logs

General

Target

Clash Verge.exe
Size

9.5MB
MD5

499fdd71a2fd059cf6b60bd9fecfb688
SHA1

461177473ceb01b845efbbe22cd3507e4cc1a25e
SHA256

00121067ba92f12bd03cf5c293892b2f9eca1891ea14d0cf36be5c7095ca8b34
SHA512

7dd403f879b50480dd07ac60906ae97f042db9ae28189593ffd7c5b972c38969b1595eba8c2611ef11f641839627378cfdeeb5cd364c1ef11527fc0472667ced
SSDEEP

196608:lUfkc0vrVMLhgUKOc6+1Pqc7Unsu/jSYet:luk6LhVhcJqco/jSX

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Clash	Clash Verge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Clash\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Clash Verge.exe"	Clash Verge.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Clash\Shell\Open\Command	Clash Verge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Clash\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Clash Verge.exe \"%1\""	Clash Verge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Clash\ = "Clash Verge"	Clash Verge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Clash\URL Protocol = "Clash Verge URL Scheme Protocol"	Clash Verge.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Clash\DefaultIcon	Clash Verge.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Clash\Shell	Clash Verge.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Clash\Shell\Open	Clash Verge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1820	Clash Verge.exe
1820	Clash Verge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1820	Clash Verge.exe

C:\Users\Admin\AppData\Local\Temp\Clash Verge.exe
"C:\Users\Admin\AppData\Local\Temp\Clash Verge.exe"
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads