Analysis
-
max time kernel
1790s -
max time network
1819s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 17:24
General
-
Target
all/gcs/encephalon_clean.exe
-
Size
4.8MB
-
MD5
21d07a078e78af8a4ccb30d0fc133ca5
-
SHA1
6f93f72e4b4b1219e0fe9b18192fd67b43666460
-
SHA256
5890b95051bdad9b5aa287265b64d85e61f26ca0368adc2f526959c660d77637
-
SHA512
dffb7351066d9ee99515a46c4612d420667b36a6f55e7aaf7b743e79ea4c76f041a9da711c5557a6439702630566db8fee3844f26969f4ecee771afb2d3d9838
Score
8/10
Malware Config
Signatures
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\all\gcs\encephalon_clean.exe"C:\Users\Admin\AppData\Local\Temp\all\gcs\encephalon_clean.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 268 -s 8922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
312KB
-
Filesize
584KB
-
Filesize
8KB
-
Filesize
4KB