Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24/05/2024, 04:54
General
-
Target
HShield/HSUpdate.exe
-
Size
150KB
-
MD5
061ac0ac3eec7b767c2d353ada7aad4b
-
SHA1
951f81e84581cacab2a953036ca8a0f3db15361a
-
SHA256
daf95bde2293271f59df320e5d934bd47e0e5b14da1d47536ef25596c9db1393
-
SHA512
96b4136dcf0a566561f2908ddd0870f5245a43ea2bbf750f81785a67c278ee2af7dfbe63c021350f9b5eda47caaf50a9b94acc780d221172b994198147e1610d
-
SSDEEP
3072:Q+V+eO276pVT86NMxWWJLhXTszFCpJI+lKMbc0Bagee/oAQ:vV+eO22Px2xWWnDssElUtQ
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HShield\HSUpdate.exe"C:\Users\Admin\AppData\Local\Temp\HShield\HSUpdate.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
479KB
MD5c7f84e4297fb3f220ab3818e819d3837
SHA1e59be8a94358419bdfd4cfe7e80cb410ef797a71
SHA2560c504aecbc57296cfac12eca6e91a0e2bda03478449d3d8679ccc62cdd154296
SHA51227ea4b6a8b539eef48e12a0bf621aa733433dc0e3b8dfbd1600c77c707bddcf95f597b2803b88294ffe4cab5c876620df5f125da191ffef811844c1602b069ce
-
Filesize
180KB
-
Filesize
140KB
-
Filesize
84KB
-
Filesize
152KB
-
Filesize
792KB