Analysis
-
max time kernel
20s -
max time network
24s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
11-06-2023 19:47
General
-
Target
DarkSpy 1.1.7.exe
-
Size
1.5MB
-
MD5
114be737f478511a07f35760c54e9e7f
-
SHA1
e857ad01581e7e07c8caca9792f4dc57f689e51a
-
SHA256
9630f80759afed753ab09152a6629312fe3bf72927e3dc1cdf7cb7bfd81518f5
-
SHA512
2ea027db9abac7f41ec7daabe199a5e145866e4adaa0ca46390c17a0d5f35d3ebf784d034365d0169bfb9e5b8b2ec6d8bd665438e79bfcd1f695e68d2fa31ac2
-
SSDEEP
12288:35iMSDNy0QskQixCaqUnvEDgqFelQ+hJzQDPZdfrXg+JwuKt/S/6058bv5:38cBnvUFea+hJqfw+Jwz/S/6Nbv5
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DarkSpy 1.1.7.exe"C:\Users\Admin\AppData\Local\Temp\DarkSpy 1.1.7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
-
Filesize
64KB