Analysis
-
max time kernel
27s -
max time network
36s -
platform
windows7_x64 -
resource
win7-20221111-es -
resource tags
-
submitted
15-01-2023 23:31
General
-
Target
FrostyModManager.exe
-
Size
506KB
-
MD5
ce2e89ab7ba7e003af3feb74ec0d1a20
-
SHA1
6861071664db9fd994d6c4bbddb5e2be192a9e98
-
SHA256
8fcdb7659bc77b23f374e6eb89427c8dda7727a25c8a8bca3bdf494fd1c801db
-
SHA512
9044e40e37c37d1ffac9890d7bf1a7093c8043231fd49945d38beee849b26cdccd2c20e3d7af6d2bd096e125776b1b8a28dad385eb468bf49d0edb6d7c74710c
-
SSDEEP
3072:8+Uv+M/88jAku6tIUpoHopGg1DSnACXdS2YUFsviH8zQq/fgSR0pm/fOiC5c2r:VUvpBOE1OnHXYUsaH8zf/ISR0pm/Gy2
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FrostyModManager.exe"C:\Users\Admin\AppData\Local\Temp\FrostyModManager.exe"
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
00:00
00:00
Downloads
-
memory/1416-54-0x000000013F6F0000-0x000000013F774000-memory.dmpFilesize
528KB
-
memory/1416-55-0x000000001BA70000-0x000000001C05E000-memory.dmpFilesize
5MB
-
memory/1416-56-0x000000001D000000-0x000000001D292000-memory.dmpFilesize
2MB
-
memory/1416-57-0x0000000000980000-0x00000000009A2000-memory.dmpFilesize
136KB
-
memory/1416-58-0x0000000002260000-0x000000000227C000-memory.dmpFilesize
112KB
-
memory/1416-59-0x0000000000950000-0x000000000095E000-memory.dmpFilesize
56KB
-
memory/1416-60-0x0000000002290000-0x0000000002298000-memory.dmpFilesize
32KB
-
memory/1416-61-0x0000000002400000-0x0000000002442000-memory.dmpFilesize
264KB
-
memory/1416-62-0x0000000002450000-0x000000000246A000-memory.dmpFilesize
104KB
-
memory/1416-63-0x000000001C060000-0x000000001C110000-memory.dmpFilesize
704KB
-
memory/1416-64-0x000000001D678000-0x000000001D697000-memory.dmpFilesize
124KB
-
memory/1416-65-0x00000000024A0000-0x00000000024AA000-memory.dmpFilesize
40KB
-
memory/1416-66-0x000000001D678000-0x000000001D697000-memory.dmpFilesize
124KB