06a7c03d5bdd96a30a32cff0ae0f587fb0e7553b40c43034b90559584adc921f | Triage

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 16:49

Sharing

Report Analysis Logs

General

Target

Launcher.exe
Size

22KB
MD5

aa13e9eb5a58de238de748f3ac473f16
SHA1

92fed74817e5ac5995961dd57010dfdd9fabe0e9
SHA256

82f2ec3be22a48f15086fbbf7b5aea027c99247a26ac2897cb205c030891ad92
SHA512

296a33d9a380abd0b22f350e162e44ceffea3310c2509f1b21161e682e64622bf9d2d02e420a9fdd0335a62ef29ecaa8ccd874c1682b39c333d9ec7c283e5199
SSDEEP

384:m+LPB3jY/QHuGziKDeOKDVrsiKDeOKDVrOB:mc53M4HIbhb+

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	Launcher.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2128	game.exe
2128	game.exe
2128	game.exe
2128	game.exe
2128	game.exe
2128	game.exe
2128	game.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2128	game.exe
2128	game.exe
2128	game.exe
2128	game.exe
2128	game.exe
2128	game.exe
2128	game.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2128	game.exe
2128	game.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2128	1300	Launcher.exe	28
PID 1300 wrote to memory of 2128	1300	Launcher.exe	28
PID 1300 wrote to memory of 2128	1300	Launcher.exe	28
PID 1300 wrote to memory of 2128	1300	Launcher.exe	28
PID 1300 wrote to memory of 2128	1300	Launcher.exe	28
PID 1300 wrote to memory of 2128	1300	Launcher.exe	28
PID 1300 wrote to memory of 2128	1300	Launcher.exe	28

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Admin\AppData\Local\Temp\game.exe
  game.exe -test -k259403797
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2128-1-0x0000000000400000-0x00000000005EF000-memory.dmp

Filesize
1.9MB

Download
memory/2128-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download