Overview

overview

1

Static

static

1

NoEscape.exe

windows7-x64

Resubmissions

31/03/2023, 17:49

230331-wegqtade5v1

31/03/2023, 17:46

230331-wctbtsde311

31/03/2023, 17:45

230331-wb591ade3w1

31/03/2023, 17:24

230331-vyn4kadc8y10

Analysis

  • max time kernel
    105s
  • max time network
    106s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    31/03/2023, 17:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    NoEscape.exe
  • Size 666KB
  • Sample230331-wctbtsde31
  • SHA256 d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
  • MD5 SHA1 SHA512 SSDEEP
Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NoEscape.exe
    "C:\Users\Admin\AppData\Local\Temp\NoEscape.exe"
    1⤵
      PID:1992
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:1968
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x1f4
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1716
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x0
        1⤵
          PID:756
        • C:\Windows\system32\LogonUI.exe
          "LogonUI.exe" /flags:0x1
          1⤵
            PID:292

          Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                memory/292-58-0x0000000002820000-0x0000000002821000-memory.dmp
                Download

                memory/756-57-0x00000000027C0000-0x00000000027C1000-memory.dmp
                Download

                memory/1992-54-0x0000000000400000-0x00000000005CC000-memory.dmp
                Download

                memory/1992-56-0x0000000000400000-0x00000000005CC000-memory.dmp
                Download