acf4946121cb03750f5066b7e1697d45e28a77bbd9d5117882a9a2c94e920ec6 | Triage

Analysis

max time kernel
11s
max time network
3s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22/07/2023, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

niggerhook.exe
Size

145KB
MD5

3f418d55f39a2f61ad201229299a3d07
SHA1

5dca3713b66273ee248a852d9dbc052ca9869d57
SHA256

acf4946121cb03750f5066b7e1697d45e28a77bbd9d5117882a9a2c94e920ec6
SHA512

b0350a210834d56bb60cc55095175d749d33d488e6170bd484a280de3bfdb89677c219f6d3a7ca4e0a81f0c09f089a35a7ab1fb5db821f68a1e1c95957e913a6
SSDEEP

3072:sjX0/u5TesPo1be9WVbNyyRnyZHrO1913utkq+Ncw9Z:sjX0/KTesPecZHrON3u9Oca

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	calc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2056	2556	niggerhook.exe	29
PID 2556 wrote to memory of 2056	2556	niggerhook.exe	29
PID 2556 wrote to memory of 2056	2556	niggerhook.exe	29

C:\Users\Admin\AppData\Local\Temp\niggerhook.exe
"C:\Users\Admin\AppData\Local\Temp\niggerhook.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\system32\calc.exe
  calc.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2556-54-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download