1f506445a54b928ed043107063729e68641f41215f72358dfa87e6722185a75e | Triage

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 17:09

Sharing

Report Analysis Logs

General

Target

659319ed29527575ae024f4b161189ea.exe
Size

20KB
MD5

659319ed29527575ae024f4b161189ea
SHA1

0ca68d66fa4dab0e65cd94ede9fbc53a8ddd7a96
SHA256

1f506445a54b928ed043107063729e68641f41215f72358dfa87e6722185a75e
SHA512

bba17f6b7c0fe319c3d87872aa6e9d021a156e33960ac1f2cd7d16af900d59e37dd3301311438d6641f319f8afe873a9ab2f695e495355b5ce327dd088d17883
SSDEEP

192:/TRDasZY93xbBZt5psEX7yjT0D3WyDUI:/ThtZIbBZt5pdyv0D3WyDUI

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

pid	Process
552	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3772	659319ed29527575ae024f4b161189ea.exe
3772	659319ed29527575ae024f4b161189ea.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3772	659319ed29527575ae024f4b161189ea.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 552	3772	659319ed29527575ae024f4b161189ea.exe	88
PID 3772 wrote to memory of 552	3772	659319ed29527575ae024f4b161189ea.exe	88
PID 3772 wrote to memory of 552	3772	659319ed29527575ae024f4b161189ea.exe	88

C:\Users\Admin\AppData\Local\Temp\659319ed29527575ae024f4b161189ea.exe
"C:\Users\Admin\AppData\Local\Temp\659319ed29527575ae024f4b161189ea.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im DreamOnline.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads