463abf705f1e359ac2ff77d6f922006bc3f68a1f82b359ef3a8cea53fe94b757 | Triage

Analysis

max time kernel
216s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 09:47

Sharing

Report Analysis Logs

General

Target

PC_Hunter64.exe
Size

6.5MB
MD5

0f523b43820492f75a01bc92f9f81704
SHA1

1c781c4e9a46f6d8614ca035cf3c7a7b08fc122d
SHA256

463abf705f1e359ac2ff77d6f922006bc3f68a1f82b359ef3a8cea53fe94b757
SHA512

2baa8402987e45c7800650cf136778c484fd8fdb19da9448fe04529d41ba450a504b163ce4a8e9f29bf19fed1ad92cc5add66420bb6b8973425f4d0bf678a69b
SSDEEP

196608:eiD3HjMKpxYgElDsscE54f3F4hLt0RsI7oMFsnIOIC:N3+L5a3FmniG

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1476-54-0x0000000140000000-0x00000001412B3000-memory.dmp	vmprotect

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PC_Hunter64.exe

description pid process

Token: SeDebugPrivilege 1476 PC_Hunter64.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

PC_Hunter64.exe

pid process

1476 PC_Hunter64.exe

C:\Users\Admin\AppData\Local\Temp\PC_Hunter64.exe
"C:\Users\Admin\AppData\Local\Temp\PC_Hunter64.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1476

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-54-0x0000000140000000-0x00000001412B3000-memory.dmp

Filesize
18.7MB

Download