Analysis

  • max time kernel
    151s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    12-10-2020 10:42

General

  • Target

    MHWv20200109-20201001FLiNG+67.exe

  • Size

    1.6MB

  • MD5

    d8d04a49a7ebe94d52daa21380c7f981

  • SHA1

    c61619f51bb3ded298be6ff4f37d657c7f4dee88

  • SHA256

    48000c42895041ab94da59597b322a9afeacac40cbd8d7654115df6eaed44708

  • SHA512

    6aa11b73cbfc871ea23ecc136e2585de98ff2989f6ac20a9db8855df0657024990a4f87cf1dc2413fd49e66c8ce57246f7405911e1b24d22e49727a4aae035e0

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 493 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MHWv20200109-20201001FLiNG+67.exe
    "C:\Users\Admin\AppData\Local\Temp\MHWv20200109-20201001FLiNG+67.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1460-0-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

    Filesize

    9.9MB

  • memory/1460-1-0x00000000004E0000-0x000000000050D000-memory.dmp

    Filesize

    180KB

  • memory/1460-4-0x000000001E5A0000-0x000000001E5D0000-memory.dmp

    Filesize

    192KB

  • memory/1936-3-0x000007FEF5830000-0x000007FEF5AAA000-memory.dmp

    Filesize

    2.5MB