Analysis
-
max time kernel
105s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
29-01-2023 14:51
General
-
Target
FrostyModManager.exe
-
Size
506KB
-
MD5
ddfaa96f9107eebd8c7c4bb70e176260
-
SHA1
5d52b3763a3db9647ff45d6b78f8caea250f0f44
-
SHA256
3e1babb9f7bdf4f2603925d1d72045289d18787dd4fd54bd8ca14eea7dbeacb3
-
SHA512
befacf1c20677e5471c3c938f43c76bfcadff016baa24f5b1391dab6b845692603712cc38884a10e0c73fb18e53eba4a9e3648c19c57081dce7643619bcbd58d
-
SSDEEP
3072:cK/Enmv14hwXJ4+apOV1HanACMdS2YUFsviH8zQa/fgrf637/fYiCus2r:1/VvSOZ6nwXYUsaH8z3/Irf637/Qb2
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FrostyModManager.exe"C:\Users\Admin\AppData\Local\Temp\FrostyModManager.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1308-54-0x000000013F250000-0x000000013F2D4000-memory.dmpFilesize
528KB
-
memory/1308-55-0x000000001BB80000-0x000000001C16E000-memory.dmpFilesize
5.9MB
-
memory/1308-56-0x000000001D030000-0x000000001D2D8000-memory.dmpFilesize
2.7MB
-
memory/1308-57-0x0000000000AA0000-0x0000000000AC1000-memory.dmpFilesize
132KB
-
memory/1308-58-0x0000000000AD0000-0x0000000000AEC000-memory.dmpFilesize
112KB
-
memory/1308-59-0x0000000000860000-0x000000000086E000-memory.dmpFilesize
56KB
-
memory/1308-60-0x0000000000AF0000-0x0000000000AF8000-memory.dmpFilesize
32KB
-
memory/1308-61-0x0000000002380000-0x00000000023C2000-memory.dmpFilesize
264KB
-
memory/1308-62-0x0000000002550000-0x000000000256A000-memory.dmpFilesize
104KB
-
memory/1308-63-0x000000001B230000-0x000000001B2E0000-memory.dmpFilesize
704KB
-
memory/1308-64-0x000000001CB58000-0x000000001CB77000-memory.dmpFilesize
124KB
-
memory/1308-65-0x00000000025A0000-0x00000000025AA000-memory.dmpFilesize
40KB