Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 21:07
Behavioral task
behavioral1
Sample
Test.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
Test.exe
-
Size
202KB
-
MD5
fefa64c75ac254a35e30ac86cc7642db
-
SHA1
8ea2327ce80327997523fb956b38cbf61554d675
-
SHA256
b29c1555150098ca7885ddd1f406b7cd6b8ee86c2574cb98de17210213d8ebbb
-
SHA512
7e4b7722af0dfdac6be6ccc9d451394c0fbb554e87ca87ea483868b2730a8781fe7bbfa791a0b614f0788248718fb7d049325e3ae5a837b4cac58262a48463f3
-
SSDEEP
6144:gLV6Bta6dtJmakIM5klE4UXkD2rovrO6mlOE:gLV6Btpmkb24ttvr5E
Malware Config
Signatures
-
Processes:
Test.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Test.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
Processes:
flow ioc 38 0.tcp.in.ngrok.io 2 0.tcp.in.ngrok.io 4 0.tcp.in.ngrok.io 13 0.tcp.in.ngrok.io 20 0.tcp.in.ngrok.io 40 0.tcp.in.ngrok.io 6 0.tcp.in.ngrok.io 15 0.tcp.in.ngrok.io 24 0.tcp.in.ngrok.io 29 0.tcp.in.ngrok.io 33 0.tcp.in.ngrok.io 11 0.tcp.in.ngrok.io 22 0.tcp.in.ngrok.io 31 0.tcp.in.ngrok.io 42 0.tcp.in.ngrok.io -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Test.exepid process 2868 Test.exe 2868 Test.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Test.exepid process 2868 Test.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Test.exedescription pid process Token: SeDebugPrivilege 2868 Test.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2868-0-0x00000000749A0000-0x0000000074F4B000-memory.dmpFilesize
5.7MB
-
memory/2868-2-0x0000000000A10000-0x0000000000A50000-memory.dmpFilesize
256KB
-
memory/2868-1-0x00000000749A0000-0x0000000074F4B000-memory.dmpFilesize
5.7MB
-
memory/2868-4-0x00000000749A0000-0x0000000074F4B000-memory.dmpFilesize
5.7MB
-
memory/2868-5-0x00000000749A0000-0x0000000074F4B000-memory.dmpFilesize
5.7MB
-
memory/2868-6-0x0000000000A10000-0x0000000000A50000-memory.dmpFilesize
256KB