Analysis
-
max time kernel
25s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
24-11-2022 06:47
General
-
Target
2a4fe9d13286ca2c68ee2aee593cbcdc85022e661fc4359a90462f08f9983caa.exe
-
Size
934KB
-
MD5
d47908522a67ea24cfd04d87023693a7
-
SHA1
56d67ab71d1b9fabb174dca43f53dbca0b68b11d
-
SHA256
2a4fe9d13286ca2c68ee2aee593cbcdc85022e661fc4359a90462f08f9983caa
-
SHA512
690a8117d48b3a2597b618b1dec3bc29416146b11e4edcff277fe9580c6ba5ebe255e2e2500c5655c150785d2ccb3bb1c64fed1e9a605c5237641af274bb5c62
-
SSDEEP
24576:AjJFUlQBk7MsTMiwgupiRTIzcrqEK7+bIsx2:0UMJgTRTI4rr1
Score
8/10
Malware Config
Signatures
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a4fe9d13286ca2c68ee2aee593cbcdc85022e661fc4359a90462f08f9983caa.exe"C:\Users\Admin\AppData\Local\Temp\2a4fe9d13286ca2c68ee2aee593cbcdc85022e661fc4359a90462f08f9983caa.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/564-54-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/564-55-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-56-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-57-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-59-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-61-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-65-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-63-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-67-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-69-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-72-0x0000000000400000-0x0000000000886000-memory.dmpFilesize
4.5MB
-
memory/564-74-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-71-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-76-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-78-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-82-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-80-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-84-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-86-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-88-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-90-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-92-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-94-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-96-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-98-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/564-99-0x0000000000400000-0x0000000000886000-memory.dmpFilesize
4.5MB