Resubmissions

16-07-2023 18:24

230716-w2bhbahb9x 5

16-07-2023 18:19

230716-wymq6sgd39 5

Analysis

  • max time kernel
    90s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    16-07-2023 18:24

General

  • Target

    Keygen.exe

  • Size

    609KB

  • MD5

    19f85a45de2dcfa8a2dbb016c3421582

  • SHA1

    8ad9f66e29cb988e98132f64b6d045bde4bee501

  • SHA256

    68f78c6fa80a3643dc8389008bb8e3632ef1ddd9927ec079a09a5a9a773d26aa

  • SHA512

    c2a5eba709968daa842f9f42ba419e0e5e27ead6df1f008ecc6a679f3ad18dce7d0ec025d8f46a19611133ae7388388916c627ef581873ec6965f915981d0289

  • SSDEEP

    12288:RT/3xaMs0/jfPxGpCZcgdD4qd0oiYlkZxmfCh:RTUUTxGgL54qyovODU

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\Keygen.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2532-54-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-56-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-55-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-53-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-58-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-60-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-59-0x00000000002E0000-0x0000000000322000-memory.dmp

    Filesize

    264KB

  • memory/2532-57-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-61-0x0000000000230000-0x0000000000232000-memory.dmp

    Filesize

    8KB

  • memory/2532-62-0x00000000002E0000-0x0000000000322000-memory.dmp

    Filesize

    264KB

  • memory/2532-64-0x00000000002B0000-0x00000000002B2000-memory.dmp

    Filesize

    8KB

  • memory/2532-63-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-65-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-66-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-67-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-68-0x00000000002E0000-0x0000000000322000-memory.dmp

    Filesize

    264KB

  • memory/2532-69-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-71-0x00000000002B0000-0x00000000002B2000-memory.dmp

    Filesize

    8KB

  • memory/2532-70-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-72-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-73-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-74-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-75-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-76-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-77-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-78-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-79-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB