Analysis

  • max time kernel
    1612s
  • max time network
    1178s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-04-2024 22:17

General

  • Target

    Moon-Predictor-v2-main.zip

  • Size

    15.3MB

  • MD5

    37ff9f227cba62bc3c853d4b2a356ccf

  • SHA1

    d5cb38fcb55f1b24ad27bc8d72c990735c0909f2

  • SHA256

    7c466c3a0668cc8ac5a189a374d8e8544c05d53f12c7f84516a5fa5b0ded8244

  • SHA512

    f43c7dd84ab6d52a5e3a434d639ce2545a4e52c1aa262f51bb4725ca2ee24017c04b776d43f544fa10eb2474feba1f7a5d46c0224f358cd166a2183b6d77043a

  • SSDEEP

    393216:IvRsHxZ/P5383bl0qUrNoto4sdS2KyzjXbDxCRVHv+wR0:02RZn53iGqc6tondVKy3rlCRtv/0

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Moon-Predictor-v2-main.zip
    1⤵
      PID:2548
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:4816
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:384

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/384-0-0x00000228EE940000-0x00000228EE950000-memory.dmp

        Filesize

        64KB

      • memory/384-16-0x00000228EEA40000-0x00000228EEA50000-memory.dmp

        Filesize

        64KB

      • memory/384-32-0x00000228F6D70000-0x00000228F6D71000-memory.dmp

        Filesize

        4KB

      • memory/384-34-0x00000228F6DA0000-0x00000228F6DA1000-memory.dmp

        Filesize

        4KB

      • memory/384-35-0x00000228F6DA0000-0x00000228F6DA1000-memory.dmp

        Filesize

        4KB

      • memory/384-36-0x00000228F6EB0000-0x00000228F6EB1000-memory.dmp

        Filesize

        4KB