Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
03-05-2024 17:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
horizon-v1.exe
Resource
win10-20240404-en
windows10-1703-x64
4 signatures
150 seconds
General
-
Target
horizon-v1.exe
-
Size
1002KB
-
MD5
2f20787b72bc0d5ea0a7403ff86fc3d5
-
SHA1
77791e89018386d76b10ca8c1fbf7ae1bd9666d0
-
SHA256
1bde000aa8fdc11c86e8982e2f67b4774ff12aa69deff8c78d6ee7c83569ee74
-
SHA512
3a35595c7cab41ce61a62277e6ed46faaee36bd83adebb970f92954dafdd3507b800c1d3577be78d44198496806e67566a953f8522d86385d0fd9dbc47a079d5
-
SSDEEP
24576:GelBI4sOMaSUx5K9D6S7xfPDeSoUeC4onvKm5RE:NBIz/LUx5K9DxqSoU14onG
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
horizon-v1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\frAQBc8Wsa1xVPfv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\frAQBc8Wsa1xVPfv" horizon-v1.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
horizon-v1.exepid process 4692 horizon-v1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
horizon-v1.exedescription pid process Token: SeLoadDriverPrivilege 4692 horizon-v1.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
horizon-v1.exedescription pid process target process PID 4692 wrote to memory of 4420 4692 horizon-v1.exe cmd.exe PID 4692 wrote to memory of 4420 4692 horizon-v1.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\horizon-v1.exe"C:\Users\Admin\AppData\Local\Temp\horizon-v1.exe"1⤵
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color B2⤵