71a4c7bdf5a3798d2bc5f12d2e0a61768f0176a32f25723a4d173d06c5fb6bd4 | Triage

Analysis

max time kernel
36s
max time network
38s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 22:04

Sharing

Reason

Machine shutdown

Report Analysis Logs

General

Target

AimStar.exe
Size

1.7MB
MD5

9f956aabc8efe55f9c3b48e0d8acf8bf
SHA1

642fc30600696c48e81f0b2a66c6de2faea6fb01
SHA256

000b590e2e871afc6052a840505bc1a59499f3cdb4ac1ee880cee978f49dac12
SHA512

da713415894ffec60932774dcae9dba485a735ef3f147f5535a690fbbbd26028c273422553596365156f99eb4c4ca6b594d9aa036ae7928590e9b1b707b61000
SSDEEP

24576:9Ki++utdFh7r0yHLFXr/QmQdCLh7/3YQGK6PP1gQe8K8VlR7mkDfca1:9F8gQ449aK6PPte+HRM

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1996	AimStar.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1676	1996	AimStar.exe	29
PID 1996 wrote to memory of 1676	1996	AimStar.exe	29
PID 1996 wrote to memory of 1676	1996	AimStar.exe	29

C:\Users\Admin\AppData\Local\Temp\AimStar.exe
"C:\Users\Admin\AppData\Local\Temp\AimStar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1676

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2596

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2596-0-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/2748-1-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download