d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21-10-2023 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe
Size

12.1MB
MD5

3ecc37c345e2cd48d006c646a8b06281
SHA1

e7d3cb94eaf72ea7b5e836c1c1fca1b7d00eba3f
SHA256

d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31
SHA512

2ac1d013abe13e3c4ae633ab1ffdd076dc235aea80553524bce022b1c063885be922c8a620d83354a222398b038f5d3d32b5a551a3d0f7448632bc6656e89a2a
SSDEEP

98304:VOQn27OrepJm9sOLJk9sOeMTbsopSxp6cPk1pfdEmQw1eqyZC6a8lSJBAUZLrxRz:lnjqqLJK6MhpW0KYeqy5SJV3xRqby6u

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\desktop.ini	d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
2064	d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe
2064	d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe
2064	d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe
2064	d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe
2064	d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe
2064	d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe
2064	d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	2064	d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2064	d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe
2064	d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2064	d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2064	d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe
2064	d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe

C:\Users\Admin\AppData\Local\Temp\d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe
"C:\Users\Admin\AppData\Local\Temp\d89b2b7463e920b2c051a4fea652baf8bd398454b498a50bd9470f7fd99bfe31.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-0-0x0000000000400000-0x0000000001010000-memory.dmp

Filesize
12.1MB

Download
memory/2064-1-0x0000000075270000-0x00000000752B7000-memory.dmp

Filesize
284KB

Download
memory/2064-811-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-816-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-814-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-812-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-818-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-820-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-822-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-826-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-824-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-828-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-832-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-834-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-836-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-830-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-838-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-840-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-842-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-844-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-848-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-852-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-850-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-846-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-854-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-856-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-862-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-860-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-858-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-868-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-866-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-864-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-872-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-870-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-2547-0x0000000002C40000-0x0000000002DC1000-memory.dmp

Filesize
1.5MB

Download
memory/2064-8686-0x0000000002EF0000-0x0000000003001000-memory.dmp

Filesize
1.1MB

Download
memory/2064-8689-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2064-8687-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2064-8691-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2064-8692-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2064-8700-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/2064-8706-0x0000000000400000-0x0000000001010000-memory.dmp

Filesize
12.1MB

Download