59bb48f0b7c22078a26b576626ec46e25f0b210588fa76a7346bef6c7063b3db | Triage

Analysis

max time kernel
154s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2022 11:16

Sharing

Report Analysis Logs

General

Target

MyMXE.exe
Size

3.8MB
MD5

0145183162d6e88d69a427968845e789
SHA1

b706f144c557fb0f47df51f4b826a9991c6c1833
SHA256

59bb48f0b7c22078a26b576626ec46e25f0b210588fa76a7346bef6c7063b3db
SHA512

83473e3b4dc0e63ddc674e545515de15feca324674672aeee892ba31a224fd2d8fa255d9ac9a2bf04a4571d08ceed83c428dba75f48c84bbd674a96c8adadb6b

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

MyMXE.exe

pid process

4880 MyMXE.exe
4880 MyMXE.exe
4880 MyMXE.exe
4880 MyMXE.exe
4880 MyMXE.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MyMXE.exe

description pid process

Token: SeShutdownPrivilege 4880 MyMXE.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

MyMXE.exe

pid process

4880 MyMXE.exe
4880 MyMXE.exe

C:\Users\Admin\AppData\Local\Temp\MyMXE.exe
"C:\Users\Admin\AppData\Local\Temp\MyMXE.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4880-132-0x0000000075020000-0x0000000075059000-memory.dmp

Filesize
228KB

Download
memory/4880-133-0x00000000753C0000-0x00000000753F9000-memory.dmp

Filesize
228KB

Download
memory/4880-134-0x00000000753C0000-0x00000000753F9000-memory.dmp

Filesize
228KB

Download