Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15-03-2024 20:34
General
-
Target
Media-Player_160889.exe
-
Size
9.2MB
-
MD5
57ae7f3dcb2bbdf3702aa2145a15a84a
-
SHA1
2467a184982fee815f369ce35d7a9a49b41f1739
-
SHA256
fd50f25603c80e0b8a147e6a1abe099cd04b3c11b5ef8b32b232a466ec1d1815
-
SHA512
9cb19919a22bd00507cecd2ec2d26608ea5bc6b3ad498d08a3074fefe53c3aae4a508275dfe0b45fe77598c6279939653bd615cfe922b06127785b69f2fa29a6
-
SSDEEP
196608:vIQYIVpSDC2cZpQKehATj+d4XLqezaQwfwsFCflWpw5qJeQJ/UQfWY62LHb0vrpt:vrYIVpSDC2CpQKemTj+dhCDgJsv6tWKW
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Media-Player_160889.exe"C:\Users\Admin\AppData\Local\Temp\Media-Player_160889.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Media-Player_160889.exe"C:\Users\Admin\AppData\Local\Temp\Media-Player_160889.exe" --ac2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-