Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
31/12/2023, 00:23
General
-
Target
2191ae98a0cdd13cd7204ebcf4fff00f.exe
-
Size
1.2MB
-
MD5
2191ae98a0cdd13cd7204ebcf4fff00f
-
SHA1
9dc8671c4a6688296ecdf9b996268acd42cb1a1a
-
SHA256
a6c47e9530b53daeef6f01acfe728f77ab9195ca11400e4d2132665a614c56a1
-
SHA512
e1c97af243a99096cacd5fe2454885bc0c7737fb708ea7c036d671a5401745396bcfd2342022b5917dbf042fd72d4dc7420e95d3b71ecd6386a48b234cc6d2ab
-
SSDEEP
24576:wzdTEHCzFasyre3vHZXQlDhGbIH/PssR6pg:wzqizFal4fZXQLAI3ssRR
Score
7/10
Malware Config
Signatures
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2191ae98a0cdd13cd7204ebcf4fff00f.exe"C:\Users\Admin\AppData\Local\Temp\2191ae98a0cdd13cd7204ebcf4fff00f.exe"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
928KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
4KB