Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
31-03-2023 03:10
General
-
Target
NovaSetup.exe
-
Size
4.1MB
-
MD5
9f5019341609a7b2bc1356a509520688
-
SHA1
aa7d86fb786baff5055c7581eb07a457fcf162b4
-
SHA256
0d33ab8f48e7046db2ef831c6297949734bb6dd8acd2e7d84afacfe2404454d1
-
SHA512
ff9e2d29758ae1305cf7b344c0a1094402738ed933ffc61440f45831a529ee25cbf18f13ca7e0648d16b5c6c4af4e89b95536a4c9c3332a5399876b582618b97
-
SSDEEP
98304:Tip6o9raOWcD9XdMPABIw/t6KHDiAwzUshkqXf0FZp:TcAOWs9XNBZ16M2HUykSI
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NovaSetup.exe"C:\Users\Admin\AppData\Local\Temp\NovaSetup.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Nova"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Nova"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4.2MB
-
Filesize
320KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
712KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
9.1MB
-
Filesize
4KB