Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
-
submitted
06/11/2023, 16:45
General
-
Target
Launcher.exe
-
Size
33.2MB
-
MD5
277c0a3b42869e991a7aa19d99cccc11
-
SHA1
273c3de99fd2902e368fd769777b402e5f2cfa28
-
SHA256
f7906c12248e662d853d134cad647cefd00530af60bb5cd3fa572d34578d6174
-
SHA512
b9ea82d17715ce712058d87eb5b292b10297bf5da245e24c52c488aa0638c04e28ba6979997433b0907d9a876ef7671c918c5c1aafc80391ddac6b8c824a6aa4
-
SSDEEP
393216:H0y7B3Zdp1uPGiSPWw1JpkZo2iaF1UuNC:Uy7Vfp1uVS+w13F
Score
1/10
Malware Config
Signatures
-
Kills process with taskkill 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\""2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM powershell.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32.5MB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
9.6MB