Analysis
-
max time kernel
64s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
29-01-2023 14:46
General
-
Target
FrostyModManager.exe
-
Size
506KB
-
MD5
ddfaa96f9107eebd8c7c4bb70e176260
-
SHA1
5d52b3763a3db9647ff45d6b78f8caea250f0f44
-
SHA256
3e1babb9f7bdf4f2603925d1d72045289d18787dd4fd54bd8ca14eea7dbeacb3
-
SHA512
befacf1c20677e5471c3c938f43c76bfcadff016baa24f5b1391dab6b845692603712cc38884a10e0c73fb18e53eba4a9e3648c19c57081dce7643619bcbd58d
-
SSDEEP
3072:cK/Enmv14hwXJ4+apOV1HanACMdS2YUFsviH8zQa/fgrf637/fYiCus2r:1/VvSOZ6nwXYUsaH8z3/Irf637/Qb2
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FrostyModManager.exe"C:\Users\Admin\AppData\Local\Temp\FrostyModManager.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1628-54-0x000000013FE50000-0x000000013FED4000-memory.dmpFilesize
528KB
-
memory/1628-55-0x000000001BCA0000-0x000000001C28E000-memory.dmpFilesize
5.9MB
-
memory/1628-56-0x000000001D200000-0x000000001D4A8000-memory.dmpFilesize
2.7MB
-
memory/1628-57-0x0000000000860000-0x0000000000881000-memory.dmpFilesize
132KB
-
memory/1628-58-0x00000000021E0000-0x00000000021FC000-memory.dmpFilesize
112KB
-
memory/1628-59-0x0000000000640000-0x000000000064E000-memory.dmpFilesize
56KB
-
memory/1628-60-0x0000000002210000-0x0000000002218000-memory.dmpFilesize
32KB
-
memory/1628-61-0x000000001AD90000-0x000000001ADD2000-memory.dmpFilesize
264KB
-
memory/1628-62-0x00000000025D0000-0x00000000025EA000-memory.dmpFilesize
104KB
-
memory/1628-63-0x000000001B220000-0x000000001B2D0000-memory.dmpFilesize
704KB
-
memory/1628-64-0x000000001B328000-0x000000001B347000-memory.dmpFilesize
124KB
-
memory/1628-65-0x000000001ADE0000-0x000000001ADEA000-memory.dmpFilesize
40KB
-
memory/1628-66-0x000000001B328000-0x000000001B347000-memory.dmpFilesize
124KB