d0c6063ff0c3a6696bf14eaee2525964071d329a5466c84eee1b35cdb8549241

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LoginMenu.exe
Size

13.6MB
MD5

2becd2d04142fd82119232d7e6d478a4
SHA1

26285ee5e6e4bfeeafcc6672723190cbc2ed72c3
SHA256

322464630bc2315e092881bacbb6508bca6b910f672402819e75b674c2aed918
SHA512

e43cb3133c376e76c52420977d618cc7412e4a713eb02030c42d9529ccbcb47ef2ea449682eae95ac018d888cb3f81c5e963f71cbd3f9393b58a9c73f2b3558a
SSDEEP

196608:GpVk1JpP7nzoiY3y4JoAf+VpHxExuNUaamMIZJ7pnOCTHPmZme3qVVJxiTBPgrGX:0k1/PoiWzWHWuWaaQVnt7e4iSOSC

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1220	LoginMenu.exe
2464	notepad.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1220	LoginMenu.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2464	notepad.exe
2464	notepad.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2464	1220	LoginMenu.exe	33
PID 1220 wrote to memory of 2464	1220	LoginMenu.exe	33
PID 1220 wrote to memory of 2464	1220	LoginMenu.exe	33
PID 1220 wrote to memory of 2464	1220	LoginMenu.exe	33
PID 1220 wrote to memory of 2464	1220	LoginMenu.exe	33

C:\Users\Admin\AppData\Local\Temp\LoginMenu.exe
"C:\Users\Admin\AppData\Local\Temp\LoginMenu.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-52-0x0000000077190000-0x0000000077339000-memory.dmp

Filesize
1.7MB

Download
memory/1220-2-0x000000013F460000-0x0000000140ABD000-memory.dmp

Filesize
22.4MB

Download
memory/1220-1-0x0000000077340000-0x0000000077342000-memory.dmp

Filesize
8KB

Download
memory/1220-4-0x0000000077340000-0x0000000077342000-memory.dmp

Filesize
8KB

Download
memory/1220-7-0x0000000077190000-0x0000000077339000-memory.dmp

Filesize
1.7MB

Download
memory/1220-6-0x0000000077340000-0x0000000077342000-memory.dmp

Filesize
8KB

Download
memory/1220-8-0x000000013F460000-0x0000000140ABD000-memory.dmp

Filesize
22.4MB

Download
memory/1220-11-0x000000013F460000-0x0000000140ABD000-memory.dmp

Filesize
22.4MB

Download
memory/1220-49-0x000000013F460000-0x0000000140ABD000-memory.dmp

Filesize
22.4MB

Download
memory/1220-12-0x0000000077190000-0x0000000077339000-memory.dmp

Filesize
1.7MB

Download
memory/1220-0-0x000000013F460000-0x0000000140ABD000-memory.dmp

Filesize
22.4MB

Download
memory/2464-35-0x0000000004690000-0x0000000007BD7000-memory.dmp

Filesize
53.3MB

Download
memory/2464-31-0x0000000004690000-0x0000000007BD7000-memory.dmp

Filesize
53.3MB

Download
memory/2464-40-0x0000000077190000-0x0000000077339000-memory.dmp

Filesize
1.7MB

Download
memory/2464-46-0x0000000004690000-0x0000000007BD7000-memory.dmp

Filesize
53.3MB

Download
memory/2464-39-0x0000000077340000-0x0000000077342000-memory.dmp

Filesize
8KB

Download
memory/2464-30-0x0000000001F20000-0x000000000396B000-memory.dmp

Filesize
26.3MB

Download
memory/2464-59-0x0000000001F20000-0x000000000396B000-memory.dmp

Filesize
26.3MB

Download
memory/2464-60-0x0000000004690000-0x0000000007BD7000-memory.dmp

Filesize
53.3MB

Download
memory/2464-61-0x0000000077190000-0x0000000077339000-memory.dmp

Filesize
1.7MB

Download