06be8cdaa16797ee5e8e3e1fbc1cd7b0f61ad5e9d0c8b3db76d5d66511a49c91 | Triage

Analysis

max time kernel
142s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2023 10:56

Sharing

Report Analysis Logs

General

Target

freevd-win-11-master/FreeVD-exe/FreeVD.exe
Size

146KB
MD5

d3c41f51e35f257f13514d9a378079f7
SHA1

4e7d6b7102947510eae205950c0520910686151f
SHA256

b5ad3b0b4ea8f2fd098c4b1acbf4da6ba997c5bceb93272efc9c11ba6d140021
SHA512

75815bb72814005e1b1d7cb588d7dff74d204d4f42bd95b4bffe79c7ac028bbab87903c43b9f4cfd6bb79dcd80dfebb73d059d6fab34257f7b45824dc9772e57
SSDEEP

3072:48vbzyQ6Y1YXrbNK+3FNxacPEMk6rRQAqTWbc:4szAXNK+3FVHRQhTWQ

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

FreeVD.exe

description pid process

Token: SeDebugPrivilege 4364 FreeVD.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

FreeVD.exe

pid process

4364 FreeVD.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

FreeVD.exe

pid process

4364 FreeVD.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

FreeVD.exe

pid process

4364 FreeVD.exe

C:\Users\Admin\AppData\Local\Temp\freevd-win-11-master\FreeVD-exe\FreeVD.exe
"C:\Users\Admin\AppData\Local\Temp\freevd-win-11-master\FreeVD-exe\FreeVD.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4364-0-0x00007FFEB06F0000-0x00007FFEB0BEE000-memory.dmp

Filesize
5.0MB

Download
memory/4364-4-0x00007FFEB06F0000-0x00007FFEB0BEE000-memory.dmp

Filesize
5.0MB

Download