d5cc57e9e7cfaca270ceddd4db69d895398a5e4cae73dc0160cc271fca8f4ecc | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 21:37

Sharing

Report Analysis Logs

General

Target

ThrottleStop.exe
Size

3.8MB
MD5

bc9be951bbed1229cab7ecbb77885cb5
SHA1

a777a87ab40e5adfac7048aaccbcffea0cc0a555
SHA256

77dceddd336cb2a00289159525b834de16a3c006fd9dcd991b232d2b10346997
SHA512

ce8c7de8e137b7b04effb83066c408087768ab176349061b99330791f20858674ae90c76583ff1f4add8db89dc25ea416efc1677de56e16a85818439180be2e8
SSDEEP

98304:ZC4lhpdW/ZmB2FbUe7F5s8dQWZ7juZoFxrI99WN7e:ZCYrgIODuWFxrI9Wq

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2808	ThrottleStop.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2808	ThrottleStop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2808	ThrottleStop.exe
2808	ThrottleStop.exe

C:\Users\Admin\AppData\Local\Temp\ThrottleStop.exe
"C:\Users\Admin\AppData\Local\Temp\ThrottleStop.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ThrottleStop.sys

Filesize
49KB

MD5
6bc8e3505d9f51368ddf323acb6abc49

SHA1
82ed942a52cdcf120a8919730e00ba37619661a3

SHA256
16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0

SHA512
c547ca802b74b93c455cdec1fe184e1d64184cddb9681b920120bc63b6c4285137e892910c9f069d35eea61c8da5b5672bbf72ea88df352d4d84e3d4094b7924

Download Submit