4f64d1caed69ca071294176e6522aa94df8a82a8806a5f92c95a936a66519e09

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

iconAnimate.exe
Size

300KB
MD5

83e0e0ae77263c09243a2bc89c2b224e
SHA1

13630e4943a1b5014b848b1b2c38d01d5f4155fc
SHA256

38e48499a11f502826e8aaaf85077fa1125376746280205f6f95c90a8c95771f
SHA512

b423056ab0f9e3e2f630f29be630202b64ba5de01a73566361aa4182f6d5b602ce15254aeb1a382fc7a4b844f2b5c183361cc005292431ac450c361d1877f6ef
SSDEEP

6144:TbCCY8IuLaicrSSqlszukmKiuwv11rf1Ar3QW0VOG:TbCYh7crSN0iuwNV1A2OG

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	iconAnimate.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21
PID 1660 wrote to memory of 1204	1660	iconAnimate.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\iconAnimate.exe
  "C:\Users\Admin\AppData\Local\Temp\iconAnimate.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-0-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-2-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-1-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-4-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-3-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-5-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-6-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-7-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-8-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-10-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-11-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-9-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-12-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-13-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-15-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-14-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-18-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-17-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-16-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-19-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-20-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-25-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-24-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-23-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-22-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/1204-21-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads