0918405ab0ab2485937af6329e7e1a6992afd98489ccb21cfe77c761328b272f | Triage

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28/05/2023, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

PlayGuy.exe
Size

256KB
MD5

f2c60169e05603caa433c518755a1dcc
SHA1

b5da7137ed04c05c19fc9d1ec739dae01703108c
SHA256

5692d7514ca92fb99e90575d4941afeeb7fe576008fe41476b22e3a968acfd2d
SHA512

10b26a4c6efcd4eccf313c4d46e7bd9eeaf2f9246557df1295cfa4527d438030e1f09fe807cb5cfcb2845bb5b99f698b43afeb9be58f67fbd1d2b319ea149eff
SSDEEP

3072:joqv8Yrc8OSDDda/LsoOlWySEDl2rfm/wTRkgxmcxq8Rzwoan308wD2Y:zJcdSDDU/41lWyPam/wFBx5on3k2

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1684	PlayGuy.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1684	PlayGuy.exe
Token: SeIncBasePriorityPrivilege	1684	PlayGuy.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1684	PlayGuy.exe
1684	PlayGuy.exe

C:\Users\Admin\AppData\Local\Temp\PlayGuy.exe
"C:\Users\Admin\AppData\Local\Temp\PlayGuy.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-133-0x0000000000500000-0x0000000000531000-memory.dmp

Filesize
196KB

Download
memory/1684-134-0x0000000000540000-0x0000000000567000-memory.dmp

Filesize
156KB

Download
memory/1684-135-0x0000000000500000-0x0000000000531000-memory.dmp

Filesize
196KB

Download
memory/1684-148-0x0000000000500000-0x0000000000531000-memory.dmp

Filesize
196KB

Download