Analysis

  • max time kernel
    36s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05/11/2022, 13:06

General

  • Target

    FastCopy64/fcp.exe

  • Size

    995KB

  • MD5

    15c5f2081119540ee775c61a93dc5321

  • SHA1

    80b9e9cdaca0f33dbdf60711508d9e9b1c516313

  • SHA256

    91aa40e224466429b37dcecc5d8e4d0c688b3bf7e16700f1ef2f00af414387eb

  • SHA512

    6941f58ab126df926db0250fa45dfad8318e2506d4416eb39aa936b501b4100fc73c0224952ba7e56e3d39b3db41ebab683737869553f7dcfb6b7f7f191f6874

  • SSDEEP

    24576:GGtlqBH/gUKPV1ar+f9w3NJTzYiNZ8yTO:GGtlqBHeN1+8K3fTk+ZY

Score
6/10

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FastCopy64\fcp.exe
    "C:\Users\Admin\AppData\Local\Temp\FastCopy64\fcp.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1872

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1872-54-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

    Filesize

    8KB