5ea34b7e57eb2739364fff49d71fbc67212b27499895774cf93406c089333a1f

Analysis

max time kernel
149s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ѫͳ1.1 .exe
Size

2.3MB
MD5

7258d5fd3bab7e9802b93573819261eb
SHA1

04beccacb05c553cb4debd377bc43403862e2b9a
SHA256

f96ae6955319db901b55aa276508d1ad6e5ac3fee50daf93993a2efff19104e2
SHA512

cd3f2e8da8e6f4b6270723075f9f2116b90fc5e5188ffa6aa4856b4cb5642a4d45f2370374c4c628f0dd0a17fce9aec3a23369d7232487ac62750725ed85a971
SSDEEP

49152:5bNNjlTAj0pkfuxLkbXMU9bmk3cMjlG91Fyc:HN9Akkfue4O3BSF

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

Processes:

Ѫͳ1.1 .exe

pid	process
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Ѫͳ1.1 .exe

description pid process

Token: SeDebugPrivilege 996 Ѫͳ1.1 .exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Ѫͳ1.1 .exe

pid process

996 Ѫͳ1.1 .exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Ѫͳ1.1 .exe

pid process

996 Ѫͳ1.1 .exe

description	pid	process
Token: SeDebugPrivilege	996	Ѫͳ1.1 .exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

Ѫͳ1.1 .exe

pid	process
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe
996	Ѫͳ1.1 .exe

C:\Users\Admin\AppData\Local\Temp\Ѫͳ1.1 .exe
"C:\Users\Admin\AppData\Local\Temp\Ѫͳ1.1 .exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-54-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download
memory/996-55-0x0000000002200000-0x0000000002381000-memory.dmp

Filesize
1.5MB

Download
memory/996-57-0x00000000007BF000-0x0000000000807000-memory.dmp

Filesize
288KB

Download
memory/996-58-0x0000000075730000-0x0000000075777000-memory.dmp

Filesize
284KB

Download
memory/996-61-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-60-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-59-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-64-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-63-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-62-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-67-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-66-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-65-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-68-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-69-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-72-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-73-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-71-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-70-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-74-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-75-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-78-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-79-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-77-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-76-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-80-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-81-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-82-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-83-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-84-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-85-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-86-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-87-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-89-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/996-91-0x0000000077550000-0x00000000776D0000-memory.dmp

Filesize
1.5MB

Download
memory/996-90-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-88-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-95-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-94-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-92-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-93-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-98-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-97-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-96-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-100-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-101-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-99-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-102-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-103-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-105-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-104-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-106-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-107-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-108-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-109-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-111-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-112-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-110-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-114-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-113-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-118-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-119-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-117-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-116-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-115-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-120-0x000000000077D000-0x00000000007C1000-memory.dmp

Filesize
272KB

Download
memory/996-869-0x0000000002200000-0x0000000002381000-memory.dmp

Filesize
1.5MB

Download
memory/996-2362-0x00000000020C0000-0x00000000021C1000-memory.dmp

Filesize
1.0MB

Download
memory/996-2363-0x0000000000796000-0x00000000007B3000-memory.dmp

Filesize
116KB

Download
memory/996-2364-0x00000000007BF000-0x0000000000807000-memory.dmp

Filesize
288KB

Download
memory/996-2365-0x0000000077550000-0x00000000776D0000-memory.dmp

Filesize
1.5MB

Download
memory/996-2366-0x0000000002200000-0x0000000002381000-memory.dmp

Filesize
1.5MB

Download
memory/996-2367-0x0000000000796000-0x00000000007B3000-memory.dmp

Filesize
116KB

Download
memory/996-2368-0x00000000007BF000-0x0000000000807000-memory.dmp

Filesize
288KB

Download
memory/996-2369-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download