Analysis
-
max time kernel
5s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-01-2023 10:38
Static task
static1
Behavioral task
behavioral1
Sample
Fnf multi indev/FunkinMulti.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Fnf multi indev/FunkinMulti.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
Fnf multi indev/assets/music/Winter-Horrorland_Voices.ps1
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Fnf multi indev/assets/music/Winter-Horrorland_Voices.ps1
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
Fnf multi indev/lime.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Fnf multi indev/lime.dll
Resource
win10v2004-20221111-en
General
-
Target
Fnf multi indev/assets/music/Winter-Horrorland_Voices.ps1
-
Size
1MB
-
MD5
9669d88cb566c6a497d321e39bf3eca2
-
SHA1
dda730ac0999241dc073379eafce780a86225e44
-
SHA256
42102523c7c197c8dba5df20955fbe3e2ab465183d260fa86c52d9bd7d10a511
-
SHA512
ddbad08a3b2445151c4fa78e085423d77fd89086e39593a7310d42b4cda2866907cfd422307adc65eda6a4c092e0ffdca1a277aea779795e4346bb1330f3a42b
-
SSDEEP
24576:LfE7kx8ZwdJMhtiYsnkhTpvEdPaf7YW4cfIHU:b1dJqykhTh8W4S
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 860 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 860 powershell.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Downloads
-
memory/860-54-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmpFilesize
8KB
-
memory/860-55-0x000007FEF3940000-0x000007FEF4363000-memory.dmpFilesize
10MB
-
memory/860-56-0x000007FEF2DE0000-0x000007FEF393D000-memory.dmpFilesize
11MB
-
memory/860-57-0x000000001B810000-0x000000001BB0F000-memory.dmpFilesize
2MB
-
memory/860-58-0x00000000028B4000-0x00000000028B7000-memory.dmpFilesize
12KB
-
memory/860-59-0x00000000028BB000-0x00000000028DA000-memory.dmpFilesize
124KB
-
memory/860-60-0x00000000028BB000-0x00000000028DA000-memory.dmpFilesize
124KB