1791d745c5825b29a98920d891de282e30aacc1eadafbe1dd0cb40a54ede7520

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

iconAnimate.exe
Size

355KB
MD5

1a8604ec57a55622f9531de94f6c050d
SHA1

68fa87099365129fcbc05a9392d304dc606aa06a
SHA256

4f1a3b03c485f947f6327dda4193692a5563e5797c474f813a7a2fd60e34ad16
SHA512

2bb636cc3a36c7e6fb3b8a350b72cf8e47a75b8b21283ca657304b18b1a2a8df9ad89f56bafd38ca8ffef5ab2c05a61c447953f9a720016dff351fd606f9bc25
SSDEEP

6144:3sYklLCo4Zxlh2ukmKiuwv11rf1Ar3Q/oZpAWSyVm:3AGo4ZrOiuwNV1AD+WhU

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	iconAnimate.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56
PID 4732 wrote to memory of 3448	4732	iconAnimate.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3448
- C:\Users\Admin\AppData\Local\Temp\iconAnimate.exe
  "C:\Users\Admin\AppData\Local\Temp\iconAnimate.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4732

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads