89b6294c3901a8c1ce279318b7d0b3156d02b224043431a5410fdb72ec3b1f58 | Triage

Analysis

max time kernel
91s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
20/04/2024, 07:06

Sharing

Report Analysis Logs

General

Target

Oni.exe
Size

139KB
MD5

dd971a904af84bca5ccba752c5dee9d6
SHA1

87e7475f2cafc3a94cd90c0580ee0fbd88c793ed
SHA256

d3897d66bee5a56223715c1c3f2a585b0d926334f8f330be5906ff9f2229b51e
SHA512

efd65bfe22a41d6d99b9dda40f293d83093417f5866afef026ff54a96619df48ca2a660867f0dd6a6c4ec3f3c2a46c57537802789cb0416f3841c2da29aa52eb
SSDEEP

3072:ZiS4omp03WQthI/US3BZC0EiRQ1G78IVn2tbSkcJ48ltE:ZiS4ompBUS3BZC0C1G78IVEc6ct

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1528	Oni.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	Oni.exe

C:\Users\Admin\AppData\Local\Temp\Oni.exe
"C:\Users\Admin\AppData\Local\Temp\Oni.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads