Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/01/2024, 02:54

General

  • Target

    keygen.exe

  • Size

    73KB

  • MD5

    3d74cfb293a6e20e00540e9f032d0c63

  • SHA1

    9e3624911c97e9bee6b16cea9bff0739dcd3f3a3

  • SHA256

    b10d97488bea300be1dfbc5ecd8b349a0daa5a3730daa5a139c2fabfd30cd682

  • SHA512

    494c556b87df0a291822b341091784397794bedfbe66ec8fbfffb2135155222e5b134bb12a0d27e656b8b5d4a8dc40b4d6d50600e3b083f858346789df8bab25

  • SSDEEP

    1536:wcLBr5zd+wSONF56pLy9j6LIDTMyiak7hIJYUY+BG6vS4nEZf:wqPzd+wt8pLgOiijlZIbvS4Y

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\keygen.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    PID:4656
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4e0 0x48c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4456

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4656-0-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/4656-1-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/4656-2-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/4656-3-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/4656-4-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/4656-5-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/4656-6-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/4656-7-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/4656-8-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/4656-9-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/4656-10-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/4656-11-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/4656-12-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/4656-13-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/4656-14-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB

        • memory/4656-15-0x0000000000400000-0x0000000000499000-memory.dmp

          Filesize

          612KB