Resubmissions

02/06/2024, 05:22

240602-f22fqscd2x 3

02/06/2024, 05:17

240602-fyspescc4v 3

Analysis

  • max time kernel
    138s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 05:22

Errors

Reason
Machine shutdown

General

  • Target

    hoic2.1.exe

  • Size

    8.5MB

  • MD5

    451c94a23536dcbba422d7612b34b6ff

  • SHA1

    0b419c8b9f60cb9cb8957a6dbccb393b5d072e43

  • SHA256

    3c9806f8e132917ef85512505fadaca733e5523c271dd2e2a6925ddb9c3d0df0

  • SHA512

    b777963ab9d21efa29528e6a126e616088205aff9e1b63453c731966dccf5f15cf30f17a933d40c98347a2d057b5f2cb40e40847f41476f0f212b28ce12e94de

  • SSDEEP

    49152:XKgsEyTPOoMjJWPDYtoAoB81BE7nNeHhkD9d5VGokmPh2U69mNGkpETUPSGvVuWs:TsEaQWrYtlKheZmq9ANP61tmf

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\hoic2.1.exe
    "C:\Users\Admin\AppData\Local\Temp\hoic2.1.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2592
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2428
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\SaveUnregister.rar"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1464
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x0
      1⤵
        PID:2232
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x1
        1⤵
          PID:1424

        Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/2592-2-0x0000000002110000-0x000000000220A000-memory.dmp

                Filesize

                1000KB

              • memory/2592-5-0x0000000000280000-0x0000000000290000-memory.dmp

                Filesize

                64KB

              • memory/2592-13-0x00000000002D0000-0x00000000002F0000-memory.dmp

                Filesize

                128KB

              • memory/2592-0-0x0000000010000000-0x00000000100C8000-memory.dmp

                Filesize

                800KB

              • memory/2592-21-0x00000000036E0000-0x00000000036E1000-memory.dmp

                Filesize

                4KB

              • memory/2592-22-0x00000000036E0000-0x00000000036E1000-memory.dmp

                Filesize

                4KB