Analysis

  • max time kernel
    120s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 23:44

General

  • Target

    Deceive.exe

  • Size

    1.3MB

  • MD5

    8601a9bf03b194b7e70de918c86235e0

  • SHA1

    ba49b40e83cd833ebf8ab62e47e10fbaec0f7de5

  • SHA256

    8ae665c9f2ce17156a11d63bf5f3400a832733cbd3686b2e272aeeac50b006df

  • SHA512

    8850df97bbdfade1534efaa2443fa5c791d5ace2793fce351caf5b559c78d4dfba787886950b750cffe13c88f4e353179e44f05184a10eaf2377cbedb5b6ba91

  • SSDEEP

    24576:9ljj1jWV0il9s7yHjTjCJTd08imlKfITk5BkAptcxBOqDVphkgRUpbch8:bjRS+i3s7yHjTjCv08llAIIcC6BOqDVl

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Deceive.exe
    "C:\Users\Admin\AppData\Local\Temp\Deceive.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2896

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2896-0-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

          Filesize

          4KB

        • memory/2896-1-0x00000000011E0000-0x000000000133E000-memory.dmp

          Filesize

          1.4MB

        • memory/2896-2-0x00000000001C0000-0x00000000001CC000-memory.dmp

          Filesize

          48KB

        • memory/2896-3-0x00000000001D0000-0x00000000001EA000-memory.dmp

          Filesize

          104KB

        • memory/2896-4-0x0000000000480000-0x00000000004BA000-memory.dmp

          Filesize

          232KB

        • memory/2896-5-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

          Filesize

          9.9MB

        • memory/2896-6-0x00000000001F0000-0x0000000000208000-memory.dmp

          Filesize

          96KB

        • memory/2896-7-0x00000000004C0000-0x00000000004C8000-memory.dmp

          Filesize

          32KB

        • memory/2896-8-0x00000000004E0000-0x00000000004F0000-memory.dmp

          Filesize

          64KB

        • memory/2896-9-0x0000000000500000-0x0000000000526000-memory.dmp

          Filesize

          152KB

        • memory/2896-10-0x0000000000600000-0x0000000000608000-memory.dmp

          Filesize

          32KB

        • memory/2896-12-0x0000000000610000-0x0000000000692000-memory.dmp

          Filesize

          520KB

        • memory/2896-13-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

          Filesize

          4KB

        • memory/2896-14-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

          Filesize

          9.9MB