Analysis
-
max time kernel
92s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 13:52
Static task
static1
Behavioral task
behavioral1
Sample
musicclub.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
musicclub.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
musicclub.exe
-
Size
4.4MB
-
MD5
69ecbfa6b6a24ab5e16bcdd899e1617f
-
SHA1
41d9cd4b611d5983a37c12a777d1497181c42cf6
-
SHA256
aadb6ae3b04b8940f2cc2c65152d9b602bc3f7f8f7809985593149f6e3c7cc83
-
SHA512
8819984e11d3b3afab5d49ee96de480254b13101da8e74e09c8a499778e8aee54f01b18faa887f5b3131da5f52b2c8497dd4f3c8c412ef37ecbaeea722d3f5a7
-
SSDEEP
49152:rOCxSImaFXmyp7U5OK91KLQBeAnUJN5pdeBv9MyoDCwYc:vUAFXmyxe1KLQBeivKy2CwJ
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 752 set thread context of 2704 752 musicclub.exe 89 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe 752 musicclub.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 752 musicclub.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 752 musicclub.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 752 musicclub.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 752 wrote to memory of 2704 752 musicclub.exe 89 PID 752 wrote to memory of 2704 752 musicclub.exe 89 PID 752 wrote to memory of 2704 752 musicclub.exe 89 PID 752 wrote to memory of 2704 752 musicclub.exe 89 PID 752 wrote to memory of 2704 752 musicclub.exe 89 PID 752 wrote to memory of 2704 752 musicclub.exe 89 PID 752 wrote to memory of 2704 752 musicclub.exe 89 PID 752 wrote to memory of 2704 752 musicclub.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\musicclub.exe"C:\Users\Admin\AppData\Local\Temp\musicclub.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\SysWOW64\ctfmon.exe -p 1234"2⤵PID:2704
-