fa925b3e76ed9daa56d7dc81d622202a7aa2649f923f97a986d214bc1ccad048

Analysis

max time kernel
142s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 22:39

Target
Cat.Goes.Fishing.v13.11.2019/Cat Goes Fishing.exe
Size 4.3MB
Sample240302-2lcnbsae44
SHA256 fab76ae5f809e690fe130857a266d822b772e91f829781a09c11b4c380b5889c
MD5 906f75296beed2234b5488f8199fc75b
SHA1 f9371f6f24a40594dcf4b96585a9f4033a70e59e
SHA512 4d156e3429ea1eb372ace4c4fd0e708b15afc99aac4c7b2b214ac74df31d8e055bdc644dac173a125f161a179c33d8f58ad33e633d101fb5fa894c6c08a8cc5f
SSDEEP 49152:S3wAodQ91UcVUFWPFVjI+bPb4fuJXsvgKbV0RnLMBTWdjeJw61:S/odyacVUKjOuJX3KSRnLM0djxa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/4036-0-0x0000000073750000-0x0000000074588000-memory.dmp	upx
behavioral4/memory/4036-1-0x0000000073750000-0x0000000074588000-memory.dmp	upx
behavioral4/memory/4036-12-0x0000000073750000-0x0000000074588000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4036	Cat Goes Fishing.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4760	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4760	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4036	Cat Goes Fishing.exe

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4bc 0x4e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4760

memory/4036-0-0x0000000073750000-0x0000000074588000-memory.dmp

Download

memory/4036-1-0x0000000073750000-0x0000000074588000-memory.dmp

Download

memory/4036-12-0x0000000073750000-0x0000000074588000-memory.dmp

Download