Analysis

  • max time kernel
    284s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    12/09/2022, 10:18

General

  • Target

    789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe

  • Size

    2.6MB

  • MD5

    0c717a4d5c7c6a0716fa3d788f0b2cdd

  • SHA1

    ccebe3bfbd0f46942c27e898b67dcd56c2dd7e27

  • SHA256

    789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05

  • SHA512

    314e1c5b4569f7ca2db449f4fe5d86dd56972ae59c08ce82618d889c2c311b5d744cb4d52fd7f89411afc30c7e185d8ef46274e2b205076b584bb74a9dd997af

  • SSDEEP

    49152:DmVRGHUBcBLZ3K5va9tNCyK4Vs9mOpLbO88y8kiaAm3EmB5hwVjrrkxCP3RcdlsG:DmVRbO5Za5voN2aso4bOKiaB3Em1wht5

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe
    "C:\Users\Admin\AppData\Local\Temp\789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1576

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1576-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

          Filesize

          8KB

        • memory/1576-55-0x0000000000360000-0x0000000000362000-memory.dmp

          Filesize

          8KB

        • memory/1576-56-0x0000000000360000-0x0000000000D8C000-memory.dmp

          Filesize

          10.2MB

        • memory/1576-57-0x0000000000360000-0x0000000000D8C000-memory.dmp

          Filesize

          10.2MB

        • memory/1576-58-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

          Filesize

          3.8MB

        • memory/1576-59-0x0000000000360000-0x0000000000D8C000-memory.dmp

          Filesize

          10.2MB