Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
31/10/2023, 01:31
General
-
Target
cryogen.exe
-
Size
13.0MB
-
MD5
26879ebe5992401f17bef095db5fd117
-
SHA1
b5b6098267678e0cd8e9633295747c094fcf87a6
-
SHA256
22ea0fdebde75b08c7f6c47269920b321db529fa87513f9b8879903ec8c157bd
-
SHA512
1fc02710940a6d4e9efa01426d6c1758df2cb16827d7844c2f78be616d307499906e269ebc3bca8634bc3d87ec5ce6867ac4a018c81187529a95b20b9dff392c
-
SSDEEP
196608:259wH3QibaKlPxU4KnZhBUEDNBKfTm3tdLFg2j4Ofd/hZ9934k0aAZJ1Bu8M:AUQJ6W7UEDNoaRdjBfd/zD34Io1VM
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cryogen.exe"C:\Users\Admin\AppData\Local\Temp\cryogen.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cryogen.exe"C:\Users\Admin\AppData\Local\Temp\cryogen.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2428 -s 2003⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
23.6MB
-
Filesize
8KB
-
Filesize
23.6MB
-
Filesize
23.6MB
-
Filesize
23.6MB
-
Filesize
23.6MB