b480c87b61c8af8b3141af262d0b82aad50aa21cf0f003089fa58dd49eef856b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

iconAnimate.exe
Size

426KB
MD5

9b61f1470bada3072365f8647292728e
SHA1

2caa1ff4eb40403c2bb1c1c3b8b531184ecd8b07
SHA256

337398c9699c53a11bd422a035371cbb8a596315895ea23b0e2494c7b6434c4a
SHA512

cf40e794c5be1792a0fc63e9cc971bd52bdace6252fba3002ca49f13c7936f92fa6615fb034a320a626f0dbfe002816eda9c8eeb3d0057935f18856ff1f16d90
SSDEEP

6144:ulYIXLG7MovlVaukmKiuwv11rf1Ar3Q2HR5mV1TiyuqnODoRPD:upi7Mo92iuwNV1Apx5OTiOOD6D

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2264	iconAnimate.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21
PID 2264 wrote to memory of 1200	2264	iconAnimate.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\iconAnimate.exe
  "C:\Users\Admin\AppData\Local\Temp\iconAnimate.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-0-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-1-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-2-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-4-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-5-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-6-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-3-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-7-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-8-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-10-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-12-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-13-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-11-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-9-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-14-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-16-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-18-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-19-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-20-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-21-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-17-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-15-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1200-22-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads