Overview
overview
10Static
static
10Moon-Predi...in.zip
windows10-2004-x64
1Moon-Predi....3.dll
windows10-2004-x64
1Moon-Predi...I2.dll
windows10-2004-x64
1Moon-Predi...1).exe
windows10-2004-x64
7Moon-Predi...DME.md
windows10-2004-x64
3Moon-Predi...ns.txt
windows10-2004-x64
1Moon-Predi...DME.md
windows10-2004-x64
3Analysis
-
max time kernel
1612s -
max time network
1178s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 22:17
Behavioral task
behavioral1
Sample
Moon-Predictor-v2-main.zip
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/Bunifu_UI_v1.5.3.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/Guna.UI2.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/Moon Predictor V2 (1).exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/README.md
Resource
win10v2004-20240412-en
Behavioral task
behavioral6
Sample
Moon-Predictor-v2-main/Moon-Predictor-v2/keys & pastebins.txt
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
Moon-Predictor-v2-main/README.md
Resource
win10v2004-20240412-en
General
-
Target
Moon-Predictor-v2-main.zip
-
Size
15.3MB
-
MD5
37ff9f227cba62bc3c853d4b2a356ccf
-
SHA1
d5cb38fcb55f1b24ad27bc8d72c990735c0909f2
-
SHA256
7c466c3a0668cc8ac5a189a374d8e8544c05d53f12c7f84516a5fa5b0ded8244
-
SHA512
f43c7dd84ab6d52a5e3a434d639ce2545a4e52c1aa262f51bb4725ca2ee24017c04b776d43f544fa10eb2474feba1f7a5d46c0224f358cd166a2183b6d77043a
-
SSDEEP
393216:IvRsHxZ/P5383bl0qUrNoto4sdS2KyzjXbDxCRVHv+wR0:02RZn53iGqc6tondVKy3rlCRtv/0
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 384 svchost.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Moon-Predictor-v2-main.zip1⤵PID:2548
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:4816
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:384