Analysis
-
max time kernel
116s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-11-2022 14:24
General
-
Target
ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe
-
Size
1.8MB
-
MD5
83a67b3bfe946eb4fda0344e14f52a3f
-
SHA1
daa9368cb6914b26a6ccb22664fbb0e69f9c825e
-
SHA256
ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502
-
SHA512
da658ebbd88d7c91c4b2b48f1d5140cf0eedbbe06c3e259cc00b90854a5c339ab1e78ae0ba991bbf4ecb87a68db220dd5e7a262d9b73ca3c5e307ad921985220
-
SSDEEP
49152:mxfvukrD927bRgOIk/1+e/uq2oGSdGCoC3/+S1Swi:ml/rDg7yOIkYsuq2oGSYb5S
Score
8/10
Malware Config
Signatures
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe"C:\Users\Admin\AppData\Local\Temp\ef78c09c7e5588a6d9b684c120d21dfc22a64f08476f606e1fcd177f60522502.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x508 0x5041⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4240-132-0x0000000000400000-0x0000000000759000-memory.dmpFilesize
3.3MB
-
memory/4240-133-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-134-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-135-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-137-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-139-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-143-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-141-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-145-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-149-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-147-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-151-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-153-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-155-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-157-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-159-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-161-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-163-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-165-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-167-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-169-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-171-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-173-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-175-0x0000000010000000-0x000000001003F000-memory.dmpFilesize
252KB
-
memory/4240-176-0x0000000000400000-0x0000000000759000-memory.dmpFilesize
3.3MB
-
memory/4240-177-0x0000000002870000-0x0000000002A3D000-memory.dmpFilesize
1.8MB
-
memory/4240-179-0x0000000002870000-0x0000000002A3D000-memory.dmpFilesize
1.8MB
-
memory/4240-183-0x0000000002870000-0x0000000002A3D000-memory.dmpFilesize
1.8MB
-
memory/4240-184-0x0000000002870000-0x0000000002A3D000-memory.dmpFilesize
1.8MB