Analysis
-
max time kernel
852s -
max time network
858s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
07-06-2024 23:35
General
-
Target
my_penis_is_hard.lol(1).exe
-
Size
903KB
-
MD5
2ddc3374433159b00c6a9e5f43e2cd82
-
SHA1
b712be05de623818c6ed708500dc35f225155e59
-
SHA256
515127d9f53fa203f3ba9cb7b7b4d1cda211294cd80254cb9954e3d7462d309f
-
SHA512
a7d9367e553476bfe9d43bb28add4f70d7e115f4575664f2d903a544c685b2c3a2d26d5279fdd873f71ccb81fcb7b6f39791216262d1326f1043ced49cd9da9c
-
SSDEEP
12288:JTUZ/Y95eo6L4ce7dG1lFlWcYT70pxnnaaoawalBa2Ley+trZNrI0AilFEvxHvB3:JqI4MROxnF7ay6rZlI0AilFEvxHiAl
Malware Config
Signatures
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\my_penis_is_hard.lol(1).exe"C:\Users\Admin\AppData\Local\Temp\my_penis_is_hard.lol(1).exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ugzyguxc.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDD90.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDD8F.tmp"3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3401⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53bc1e5b7f00ba19bbea7697df1c3a32d
SHA1a8a01753168c2f497fb3029487a601c22f326f5a
SHA2567fd20b2507bdbe466ace4e6a4171517681d31a6958d28289fd93aeb897e19aff
SHA5129de22239bf15901faa4807bf9b79f62fd5b25836a2613c59c3152aca07079836f6fda3c96fb89c58f9b85fd603517ab8065158cc228729ab860c8d940f3df6b2
-
Filesize
76KB
MD5e9b7462ad354201e99f0f116896a3248
SHA11a5b6f2279f986e2db1ab123739c5f0e2e15a9d6
SHA25629bceae71675ebd2b093661c122a8d4e9758af4dda3fd26b4997b21babb07526
SHA512803a65b3aa852ee06d90206b944a05741c89db491d302fbc5a79378c4356262b5c5720f80c84ca922dc0ffb651527bffc5a2a7077b7d0e9f1e9bbb7ad70152de
-
Filesize
676B
MD5eab6c1e9ff52abf6db632bbb4441ec12
SHA145259929feda489ea49b9b8629bfbdbae333e17a
SHA256cd481fe09ed5ae34430b52ad38a7fdbe8c9bc3a545b8297568308c4c6a06aa7b
SHA512f53050feccd11afdc8003b3fd03538831ea67d83ff014efde3ce35284808b6215b0be1d6642ead1eba079c6a7a3f0d7939c92ebe1583264eee558f32bda16640
-
Filesize
208KB
MD556dc9dc34ae9a00faeae6dc62bdd0cb7
SHA1bcf5e6d9d28105a656f41d00ef05ee2c389fe7a3
SHA2563f6368a35155da5c68cc09f7bf8431f4060ab71d459a93e7997b678d3a18d198
SHA5126ad11166b9e920d215477b0791d29fe02633a415753fff198330c141e33955549aa975c609f414bebfe9c5c15f691519f4cf2cd0c400ac1d4ae5e11444d26954
-
Filesize
349B
MD52b97152a951e82be6cf0db5413b432ec
SHA1fe721a6ff4c37773b1550939b4b89bdbe5cc72f9
SHA2563323cf7838c230e6c76ee4b3ffa9a480d2584e9fbc3fc640c7c0442359e1f878
SHA5126b10020a604809392d03b1ee6a00fb75e23a3a2348f6122b12da8dcc7fffb0596579c6c80bf600fcf1faf1a7dccf6f219c369f20856f06f7f7702591faa027b3
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
392KB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
56KB
-
Filesize
88KB
-
Filesize
368KB
-
Filesize
9.6MB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
624KB
-
Filesize
5.7MB
-
Filesize
960KB
-
Filesize
120KB
-
Filesize
292KB
-
Filesize
448KB
-
Filesize
9.6MB
-
Filesize
1.2MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
1.5MB
-
Filesize
9.6MB
-
Filesize
9.6MB