Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08-01-2025 14:17
General
-
Target
NOGHCV09800.exe
-
Size
1.4MB
-
MD5
52213367d8528d5da7e3ed356d80ddc3
-
SHA1
f99fa064f78f516f7b4e6a0167fc54a193cd642d
-
SHA256
17a545082a45c4c219bd09093349cb12cafef84e37a8dd989b6382a434b89544
-
SHA512
a1d4fadf5dbfb32bdc6939b12d0f11c09be991fb1a397d4bfe97db880baf0d8803103be5166993038b79b8ec3f03122c4e44703d7485a6b77bc97c17a777472e
-
SSDEEP
24576:CiUmSB/o5d1ubcvI9/0XhFXSQMJ/ZDfJvXnaPw9Qs287sKeXnusOag6hj3:C/mU/ohubcvIx0xFXtMr7JvXa4x28Knt
Score
5/10
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NOGHCV09800.exe"C:\Users\Admin\AppData\Local\Temp\NOGHCV09800.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
-
Filesize
4.0MB
-
Filesize
2.9MB