Analysis
- max time kernel
16s - max time network
16s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
27/01/2024, 16:27
General
- Target JHgYGQja.exe
- Size 4.8MB
- Sample240127-tyk68sfff5
- SHA256 5890b95051bdad9b5aa287265b64d85e61f26ca0368adc2f526959c660d77637
Score
7/10
Malware Config
Signatures
- VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JHgYGQja.exe"C:\Users\Admin\AppData\Local\Temp\JHgYGQja.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2936-0-0x000001BC437D0000-0x000001BC43F22000-memory.dmp
memory/2936-1-0x00007FFAD5910000-0x00007FFAD63D1000-memory.dmp
memory/2936-2-0x000001BC5E520000-0x000001BC5E530000-memory.dmp
memory/2936-3-0x000001BC442C0000-0x000001BC442C1000-memory.dmp
memory/2936-4-0x000001BC45B10000-0x000001BC45B5E000-memory.dmp
memory/2936-5-0x000001BC5F600000-0x000001BC5F692000-memory.dmp
memory/2936-6-0x000001BC5E520000-0x000001BC5E530000-memory.dmp
memory/2936-7-0x000001BC44350000-0x000001BC44362000-memory.dmp
memory/2936-8-0x000001BC5E520000-0x000001BC5E530000-memory.dmp
memory/2936-9-0x00007FFAD5910000-0x00007FFAD63D1000-memory.dmp
memory/2936-10-0x000001BC5E520000-0x000001BC5E530000-memory.dmp