Overview

overview

8

Static

static

3

horizon-v1.exe

windows7-x64

8

horizon-v1.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    47s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 17:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    horizon-v1.exe

  • Size

    995KB

  • MD5

    7d2c633f40ac76b349778fabaaddc61d

  • SHA1

    7e490607c571c9bddbd36445d52e55eb52e9cb98

  • SHA256

    c66b69d8b18e6ce2f52e5cda45cdce3984bff35c477992960913050df6afb1f6

  • SHA512

    d9d7ef1a1e47e8b1941cc6ab69c3e3fb09c3bce2f834d48f1b243cb451dc21bb3de3a8475b544c7becd3e49772f5ad7af72840ed3ab0c8f00ab77d6255a35e5a

  • SSDEEP

    24576:fvwDbUzDn15DBzSbcoQQREEEikoU2ahQ09GswKt+q2x:XwDbuD15DBzc0xloUthQ0

Score
8/10
persistence

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\horizon-v1.exe
    "C:\Users\Admin\AppData\Local\Temp\horizon-v1.exe"
    1⤵
    • Sets service image path in registry
    • Suspicious behavior: LoadsDriver
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c color B
      2⤵
        PID:1920
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2872 -s 112
        2⤵
          PID:2704

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2872-1-0x0000000140000000-0x00000001405E8000-memory.dmp

              Filesize

              5.9MB

              Download