92bb068870bc42d74e74808666e395f676e328d1e89b99bcb061bcc3410a464b | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
14-11-2023 22:24

Sharing

Report Analysis Logs

General

Target

NovaHack.exe
Size

408KB
MD5

768cc5bbd4ea309b196c56ad95f6fc58
SHA1

aa878a7e7107f31805f0aec0db611be050e3f298
SHA256

92bb068870bc42d74e74808666e395f676e328d1e89b99bcb061bcc3410a464b
SHA512

ecb3458422126ef3bf5e97980f40892a933cec361306d7b00c6fdf6916494d603a8568ea39ee56d8c0e00eb342ad82c3889042c46d7a17dcf5b4ba5612e22280
SSDEEP

6144:LB6rWKF/vDcCKjWsqt6u8mX3KAp2591/nZ7WXYZ5hxnBp3mYf1V:LAdnzXKlz1vWa5hxnqo

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2384	NovaHack.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2760	2384	NovaHack.exe	29
PID 2384 wrote to memory of 2760	2384	NovaHack.exe	29
PID 2384 wrote to memory of 2760	2384	NovaHack.exe	29

C:\Users\Admin\AppData\Local\Temp\NovaHack.exe
"C:\Users\Admin\AppData\Local\Temp\NovaHack.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2384 -s 196
  2⤵
  PID:2760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads