f1bbcc5c678d174d858ae089f4494e3ea8bcfc418098d61804a15e437f08aff7

Resubmissions

03-07-2024 22:59

03-07-2024 16:13

03-07-2024 16:11

10-05-2024 16:25

24-08-2023 11:16

max time kernel
155s
max time network
175s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24-07-2023 06:25

Target

[email protected]
Size

484KB
MD5

0a7b70efba0aa93d4bc0857b87ac2fcb
SHA1

01a6c963b2f5f36ff21a1043587dcf921ae5f5cd
SHA256

4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309
SHA512

2033f9637b8d023242c93f54c140dd561592a3380a15a9fdc8ebfa33385ff4fc569d66c846a01b4ac005f0521b3c219e87f4b1ed2a83557f9d95fa066ad25e14
SSDEEP

6144:lqHKx3YCgy8HmmjJpnVhvLqCO3bLinIz1wASx:lqHoyHNj/nVhvLcyII

Score

7^/10

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LOGON.exe	[email protected]

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2540	[email protected]

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	[email protected]

memory/2540-55-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-54-0x00000000001D0000-0x0000000000252000-memory.dmp

Filesize
520KB

Download
memory/2540-56-0x0000000000350000-0x0000000000390000-memory.dmp

Filesize
256KB

Download
memory/2540-57-0x0000000000350000-0x0000000000390000-memory.dmp

Filesize
256KB

Download
memory/2540-188-0x0000000000350000-0x0000000000390000-memory.dmp

Filesize
256KB

Download
memory/2540-189-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-190-0x0000000000350000-0x0000000000390000-memory.dmp

Filesize
256KB

Download