Analysis
-
max time kernel
59s -
max time network
63s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 20:33
General
-
Target
4ed65df9e3744ed07c63836e0c76c4adf9d8858f3f2132270c967cd6785cfebb.exe
-
Size
10.9MB
-
MD5
301911b0adeaed9fbd662d1e394f7f5f
-
SHA1
ec5bb587917ea601f804899536a2c0b59531d9be
-
SHA256
4ed65df9e3744ed07c63836e0c76c4adf9d8858f3f2132270c967cd6785cfebb
-
SHA512
1db09c51cc8664c0ae51e220b1bee7fb157d95bf2b6b64d1e95854d155991426a4206b20632448f606f0e4513319b9207014a560a94ee288d16bb54999a8c7fb
-
SSDEEP
196608:hqFOkolbnEdwOyfqRH2bZJhVWzpJofBNGwkgt2p9qm1:uyodwOVE/h0zpiA7yhm1
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 3 IoCs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ed65df9e3744ed07c63836e0c76c4adf9d8858f3f2132270c967cd6785cfebb.exe"C:\Users\Admin\AppData\Local\Temp\4ed65df9e3744ed07c63836e0c76c4adf9d8858f3f2132270c967cd6785cfebb.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1232-54-0x00000000760B1000-0x00000000760B3000-memory.dmpFilesize
8KB
-
memory/1232-55-0x0000000000400000-0x0000000000F40000-memory.dmpFilesize
11.2MB
-
memory/1232-56-0x0000000000400000-0x0000000000F40000-memory.dmpFilesize
11.2MB
-
memory/1232-57-0x0000000002890000-0x0000000002902000-memory.dmpFilesize
456KB
-
memory/1232-58-0x0000000000400000-0x0000000000F40000-memory.dmpFilesize
11.2MB