Analysis
-
max time kernel
74s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
16-07-2023 05:05
General
-
Target
keygen/kg.exe
-
Size
274KB
-
MD5
3b4d64258593a36db824dd09394fd7bc
-
SHA1
52838b9dd2dfc6bde5fb26b4832c1572f838dd05
-
SHA256
bd281b3bf4c15e41f8b40b4259babdc7279d02eae5e3136b388c3ed02092c74e
-
SHA512
2df872dd784c582090df34f42f71bd1a8864f7a8ee0042b37182176c6a95e6d28f615bf4b7162f38473be0078230d2be420259894b981e1699de9802dbfc8e52
-
SSDEEP
6144:CAqimqS3lEL7YpAJ5I+b6DuMsfuqaeiSp5dwO1WfF5c8PoSt:zqiI2L73PbKvSiSAFF5roS
Score
7/10
Malware Config
Signatures
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Runs regedit.exe 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\keygen\kg.exe"C:\Users\Admin\AppData\Local\Temp\keygen\kg.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4b4 0x2cc1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"1⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804KB
-
Filesize
4KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
4KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB