Analysis

  • max time kernel
    190s
  • max time network
    202s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 03:02

General

  • Target

    0c64bc2a1c9496181e79c3aa75445b41.exe

  • Size

    1.7MB

  • MD5

    0c64bc2a1c9496181e79c3aa75445b41

  • SHA1

    80fd654d987bc9dec2fc17e2a505167c7ca55e94

  • SHA256

    5b210b801613f51262f0d2fcefdb5bfa57515b4b30cdced418eaf54a49c781d9

  • SHA512

    7e140679b6fbd15f94773a661ac59f40e2aad9aadce40778ff4d05ad24923d5da578f04561731b7652019a41fcbf41367f3c958cce13ede34ea2fea322eac4a8

  • SSDEEP

    49152:E6Puvkka04IgQcbGoCSw4EDnPiCLM3bhVPaS:8ZVLo2CF3b/

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c64bc2a1c9496181e79c3aa75445b41.exe
    "C:\Users\Admin\AppData\Local\Temp\0c64bc2a1c9496181e79c3aa75445b41.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3860-0-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-1-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-2-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-3-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-6-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-7-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-8-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-9-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-10-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-11-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/3860-13-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-14-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-15-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-16-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/3860-17-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-18-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-19-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-20-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-21-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-22-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-23-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-24-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/3860-25-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB