Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/11/2024, 18:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ShellExperienceHost.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
ShellExperienceHost.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
ShellExperienceHost.exe
-
Size
823KB
-
MD5
cd677d6d41b6a65444c304511c942f3d
-
SHA1
02144b44b58a9ac55f4fc4c3efdf1b329d02cd47
-
SHA256
34cdbec1ccf9e06a8a2db8d2e3952c77e74bd33ae19f2ef5c69b57d3eec05194
-
SHA512
d153c19c892ac15a73fee300f57d5105f5ef93b5a3ff5f672f71429ffd3bb6b36f44f757b5341780f6141e80d7d26e545ce56d4ec45ea35dfe698f82d3d7ef65
-
SSDEEP
24576:s2IeXdu9TrIKbTaxXN/D2Q0flhY0p6Bk:DIetK3IKT492/Yeuk
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe 1668 ShellExperienceHost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 6004 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1668 ShellExperienceHost.exe Token: SeDebugPrivilege 6004 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe 6004 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2440 notepad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32 PID 1668 wrote to memory of 2440 1668 ShellExperienceHost.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\ShellExperienceHost.exe"C:\Users\Admin\AppData\Local\Temp\ShellExperienceHost.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2440
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6004
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
600B
MD5c6dc42b7bd470e0d308105fc29322fda
SHA1e89d568920e7db9ad00989ed9b4c4abf2190d690
SHA256d9c34ee84d07475b773c98cb0d91128239ec92d4b4de88fd88092d6890c7c74c
SHA51246a623550574a906459255e7dfdd65304d5343e4d0736104539b61dadb93c74aae64837a391707f051697611724ce50f8045115ec4701aa0722146eca527331a