Resubmissions
19-10-2023 11:09
231019-m9hf6agh68 10Analysis
-
max time kernel
414s -
max time network
426s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-ja -
resource tags
-
submitted
19-10-2023 11:09
General
-
Target
OpenedFilesView 1.80/OpenedFilesView_64.exe
-
Size
161KB
-
MD5
3a141e17cc040541f41c91954a0d7107
-
SHA1
223b2d434945be1737e6293324f70ac356c17820
-
SHA256
4b0e6fd66ab11eb0ea8b5f022af6056ba9fe4fbcfe2e2338f1f81cc797907f71
-
SHA512
7c69b6c3d73958f722635877548f8862e65af2fe51c3dde895d76d04730d46392312541ceab3d77eb1f53653d951af3fd94ca433c1611bbb1f9490bf03f61a02
-
SSDEEP
3072:Hmq9CBOQi2vHXyNI7wEHy7uesh21ekARA8pw:3mGUHiEyKM1e+
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OpenedFilesView 1.80\OpenedFilesView_64.exe"C:\Users\Admin\AppData\Local\Temp\OpenedFilesView 1.80\OpenedFilesView_64.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken