Analysis

  • max time kernel
    143s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 18:12

General

  • Target

    0ae1b287fbcce519390dde5ca29df832.exe

  • Size

    1.7MB

  • MD5

    0ae1b287fbcce519390dde5ca29df832

  • SHA1

    d74d75eb6944de0bfe2196e8eb12ebecf6fedc5e

  • SHA256

    d3ac680020ad458bc71c3c28a7a568514c7a2d2bae1322f84ab1ba66d8ba84c1

  • SHA512

    d811286dcc9913118ca06cb4c5cabdbac8a3dd534857d882590d4d55b7a046778592a7200040e367661a051e40e5b257969e213bed64d2885f746e0c98cb1a88

  • SSDEEP

    49152:zaVRehfzBkk8XRHVDIwwT96bGgto0BUibkt/:CRehfKk8X9ZwT+tob

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ae1b287fbcce519390dde5ca29df832.exe
    "C:\Users\Admin\AppData\Local\Temp\0ae1b287fbcce519390dde5ca29df832.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/408-0-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/408-2-0x0000000000B10000-0x0000000000B5B000-memory.dmp

    Filesize

    300KB

  • memory/408-4-0x0000000000B60000-0x0000000000B61000-memory.dmp

    Filesize

    4KB

  • memory/408-3-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/408-5-0x0000000000B90000-0x0000000000B99000-memory.dmp

    Filesize

    36KB

  • memory/408-9-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/408-10-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/408-13-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/408-14-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/408-11-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/408-6-0x0000000000B70000-0x0000000000B89000-memory.dmp

    Filesize

    100KB

  • memory/408-15-0x0000000000F50000-0x0000000000F51000-memory.dmp

    Filesize

    4KB

  • memory/408-7-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/408-1-0x0000000000B10000-0x0000000000B5B000-memory.dmp

    Filesize

    300KB

  • memory/408-25-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/408-26-0x0000000000B10000-0x0000000000B5B000-memory.dmp

    Filesize

    300KB

  • memory/408-28-0x0000000000F50000-0x0000000000F51000-memory.dmp

    Filesize

    4KB