Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
15-01-2024 02:23
General
-
Target
ssClientWin3.0/winclient/ssc.exe
-
Size
341KB
-
MD5
866466aa2abd0c3a01d85ec2bd9bdef9
-
SHA1
b0452e10a86f0db216c06ce9da46d7f7900fb59d
-
SHA256
433dbc2add9dc63d21606b1fc0097b6bb5709138af2ac2230aca2fd71eba912e
-
SHA512
e0f2dec62b207176b2f8c6dc0153bb59a05da8b6ac1a94a8b9e638b7c2479228d206f3b5a1995cbf59c2cec0006cfaad8c5ddc43f724f26214704d7873020879
-
SSDEEP
6144:qRdJQMPb0qsIS0j9Kn7VeXaDMz1au2wKzJwWE5ZQypO5h0fdSK5VD9kU/:ydJQkp1S0jWAz1aVJRE5Oyg58SU
Score
7/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ssClientWin3.0\winclient\ssc.exe"C:\Users\Admin\AppData\Local\Temp\ssClientWin3.0\winclient\ssc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exe"C:\Windows\system32\WerFault.exe" -k -lc NDIS NDIS-20240115-0224.dmp1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
920KB
-
Filesize
4KB
-
Filesize
920KB
-
Filesize
4KB