Resubmissions
06/06/2024, 14:26
240606-rr1x1agc93 706/06/2024, 14:23
240606-rqb79agc63 706/06/2024, 14:19
240606-rm83tafc5s 7Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
06/06/2024, 14:26
General
-
Target
Spark Clicker.exe
-
Size
6.1MB
-
MD5
1eb8146f8c8a9faee483039585347ce0
-
SHA1
f98fd066d30658c35d5abdb2432f3adff142b813
-
SHA256
55397cfeea42a91fbae9e11a2365501df943175e2df5b2ffe6505cbf51f0798b
-
SHA512
b0605500bc835773cd621c973580873f301ae752c7319f08fb3ce4f1d3a05ff1ce748b86c9ac60abfaf930ab12ca48b0e100492e0020e763ba565fb8b6add304
-
SSDEEP
98304:pY0lYn54JO2GS/eX/cc7m2eUZmepnzPuMStE1HI0+gtr9jTA3k7kvH:mPaJkQc7feUFLuMr1t+cZuH
Score
7/10
Malware Config
Signatures
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Spark Clicker.exe"C:\Users\Admin\AppData\Local\Temp\Spark Clicker.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
11.5MB
-
Filesize
156KB
-
Filesize
3.9MB
-
Filesize
11.5MB