3a5b1dee5630e43c7bbfe03d5ba62191db33198c262fdb0316afda39ac3f70ce | Triage

Analysis

max time kernel
23s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 12:15

Sharing

Report Analysis Logs

General

Target

Project Red/Project Red.exe
Size

1.4MB
MD5

a9a76b7c6077f8bcdb81f7ff6787b573
SHA1

5c2e2008b44bd2a80953241c776c705009e0ee75
SHA256

81f8e663f27541f9d71575265bc2a1670e7105b195f0af43e1b3cd3cf8e85388
SHA512

1cc1456b26d0b0b4d4258dd6bb643cebb496caf48143ce002dc39206018ca8f82e599c874b7becdb8e3f2dfe74a512f8f41cabfc2f567e0f92b02c22500e2f0a
SSDEEP

24576:K69pzSnMjtLbk5hpB99VvKe1Wk/jA12uGKFzFTSpkP8Hn:5vkrL99VvKaWkUnFTFKn

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2844	Project Red.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 4200	2844	Project Red.exe	94
PID 2844 wrote to memory of 4200	2844	Project Red.exe	94

C:\Users\Admin\AppData\Local\Temp\Project Red\Project Red.exe
"C:\Users\Admin\AppData\Local\Temp\Project Red\Project Red.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads