Resubmissions
23-10-2023 22:11
231023-139hysgc91 523-10-2023 22:10
231023-13q2lsgc9x 523-10-2023 22:08
231023-12jk5sgc8w 5Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
23-10-2023 22:08
General
-
Target
Toysoldier.exe
-
Size
6.7MB
-
MD5
30f085bc02e0f3d3962e778c126d3741
-
SHA1
5866325bb118257b4d2fe1f1763806ec1b55b052
-
SHA256
832f0e0bfbee83129167535bef4de0fcf1c6973868be611d9a9e3843c2073a9e
-
SHA512
88d5c08e3dd385a20ec38c25610eaf1f4cdde5336f796fe0f3c4d6c301c6652210a3c27632e24e92d5f0b8acfc81b91ba21fdd761e3fc2331e439d93839e0f43
-
SSDEEP
98304:eCmGTzpfWVykI5gHxXHat5eEka5TCcFTjcTEQtGx7AqSdWSX+6:eCmGTVuVjnZaveEka53jX9AhoI+
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Toysoldier.exe"C:\Users\Admin\AppData\Local\Temp\Toysoldier.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.7MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
13.7MB
-
Filesize
13.7MB
-
Filesize
2.0MB
-
Filesize
760KB
-
Filesize
1.6MB
-
Filesize
13.7MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB