Analysis
-
max time kernel
744s -
max time network
750s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
07-06-2024 23:33
General
-
Target
my_penis_is_hard.lol(1).exe
-
Size
903KB
-
MD5
2ddc3374433159b00c6a9e5f43e2cd82
-
SHA1
b712be05de623818c6ed708500dc35f225155e59
-
SHA256
515127d9f53fa203f3ba9cb7b7b4d1cda211294cd80254cb9954e3d7462d309f
-
SHA512
a7d9367e553476bfe9d43bb28add4f70d7e115f4575664f2d903a544c685b2c3a2d26d5279fdd873f71ccb81fcb7b6f39791216262d1326f1043ced49cd9da9c
-
SSDEEP
12288:JTUZ/Y95eo6L4ce7dG1lFlWcYT70pxnnaaoawalBa2Ley+trZNrI0AilFEvxHvB3:JqI4MROxnF7ay6rZlI0AilFEvxHiAl
Malware Config
Signatures
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\my_penis_is_hard.lol(1).exe"C:\Users\Admin\AppData\Local\Temp\my_penis_is_hard.lol(1).exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rvpus7mv.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES443E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC443D.tmp"3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2c8 0x1501⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5210a44758bc523c6154a0ec9a8196fcb
SHA1c51b1ab8dccf19fa4d3bb6cbf4b95b7b4f712381
SHA25659a59033f70a0f5290d643177d51640574cceab34bb6199d7de794ecc22508df
SHA512f0cfde59bdf64043e65c8acb0b112162e5b51583b56c44f30088dbffba572f482d8569713b4faf8aeb86855775e77cb981a3daeb9bc3119ddc5f4756bdcdfc78
-
Filesize
76KB
MD52a822be3a1817446a45eb2fb0e705fee
SHA1f9ea0f6b98865d690ec0c436a48893ca78d62fbc
SHA256455950eda6810783dc5aeef3740cc198b98c3ab2fc22eef5381aaeaf1abd9623
SHA5127073be0ae3d6dcd54ffacb4cd482e9f79309d10e6650a5312913f878c6e01c969d6e372efca136ed3fa855874d6cbc2a55b061b1a88d4e3b7831e51b7314350f
-
Filesize
676B
MD51d28c47ff858fd654c784f3478087739
SHA15ec82c8bfbf314f4c5c7fc66c42cb5fdc111f64f
SHA256e13dced37e4f2b935a729377dc124046dfefba8b263d32a34e3b509ad061a4c9
SHA51247e3ee986f8351827e92b23989724a07e9fe89e80d9f450a24e470e10cd1942a6d59423340c97ed6c5a0115c6741f5bb2d3829c150528428e6fe265ca9a40693
-
Filesize
208KB
MD5a0d0e900084863f6b12984145088e73c
SHA1980a7ad9a0680e5fedf90d1641ae2f2be0c8551f
SHA25604c503e8aa6bb625790cc65b0544a9245f30d73ef8895147275adda5ee0aee3a
SHA512aed3cc8b7479b89f75c2b6222772c5644d1d5dd00b1181b7c5ddf1ee78fd21f325599be2a38ef97f080bb8e74db5ecc5b81d960a64cc516a1351892d0ccbd069
-
Filesize
349B
MD59260ae3eceb8e1f4a8030fdd4271a590
SHA133354302ee7fa7367fdfe8a2eea6f26ff854f6d7
SHA25637b3122020b7490ffbd331a0fa3aba6a6c9377e0128a12aac720e850e2b33e96
SHA512a0f55508525cc1b86b064984b87e454ff43e5374b154e0d5ce851b6660364b810e2393042b7e1ad0965eefa74cb51e9c8ffeb7545bd1c144dc2e2c617f5a99ef
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
96KB
-
Filesize
5.7MB
-
Filesize
624KB
-
Filesize
4.8MB
-
Filesize
56KB
-
Filesize
368KB
-
Filesize
88KB
-
Filesize
9.6MB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
392KB
-
Filesize
9.6MB
-
Filesize
960KB
-
Filesize
120KB
-
Filesize
292KB
-
Filesize
448KB
-
Filesize
9.6MB
-
Filesize
1.2MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
1.5MB
-
Filesize
9.6MB
-
Filesize
9.6MB