67d6209333e689623d8a2fa6b0f19cc84ae3d1eb3e78be446d9b5eee32c4ddcb | Triage

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 13:51

Sharing

Report Analysis Logs

General

Target

aha.exe
Size

777KB
MD5

c4dd13e7b907a7c5042d408b992f337f
SHA1

4c7777bd8a397d3f5b2935432f29099bbe88fa97
SHA256

67d6209333e689623d8a2fa6b0f19cc84ae3d1eb3e78be446d9b5eee32c4ddcb
SHA512

39761e0d89943298121e1fc7c330eaed13363fba2e304eaa2b882c681c54b11bafffc8e7c7f6a4d6167f80765003b040cd02c2169ca50ddf0fd5a8d79ef73e12
SSDEEP

12288:mqzcpVgUXzL0TTUKZHTNloEkOpnKgofuIwV6eAj0wZxxXMcEe/3paPcgCX:mqzcpKIL0TvZzNlNky0wVW0wZxxVgCX

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1056	aha.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1056	aha.exe
Token: SeDebugPrivilege	1056	aha.exe
Token: SeTcbPrivilege	1056	aha.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1056	aha.exe

C:\Users\Admin\AppData\Local\Temp\aha.exe
"C:\Users\Admin\AppData\Local\Temp\aha.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads