b6e83a6405e55f1a8bbfc3199c59df10a40dd5e0afeae99c7931524f09a498c4

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ashes of the Singularity Escalation Promo Trainer.exe
Size 1.0MB
Sample240613-jd3wfazapc
SHA256 97ddbce400b4997539dd26141bc9fa919d6f01b650c6d4e00ca52615b8eb190e
MD5 83935472894dc2a57d57356dd85faf58
SHA1 b1fd8e761e61086fdf717ea988ef98af17417c11
SHA512 cea4a928b830f5b5a03a89f16255937b53662a8b2ce4fc0ade114c12c120467dd120114912784980e6ae92f6b1152f6b6ded78a1baa00447ad605d859cb9006d
SSDEEP 24576:39WNNYaPyjJoYE9k1RCVezFMcIPTfwQmilHAxxayijJBV1Ls2wBP:3eNrcuk1RC9TtmKgxxayQJBV1Ls2wB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4600	Ashes of the Singularity Escalation Promo Trainer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	Ashes of the Singularity Escalation Promo Trainer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4600	Ashes of the Singularity Escalation Promo Trainer.exe
4600	Ashes of the Singularity Escalation Promo Trainer.exe

C:\Users\Admin\AppData\Local\Temp\Ashes of the Singularity Escalation Promo Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\Ashes of the Singularity Escalation Promo Trainer.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.debug

Path C:\Users\Admin\Cheathappens\Debug\.debug
Size 166B
SHA256 9d3924af94a4e74da43e71c556a39d32166b44d88bdeafd6b4f8698913697173
MD5 343e9b9e059c7ee529e4396c5710960a
SHA1 659b2913e3ea79cb7e9f3225b7d3b1fbb07f4094
SHA512 373d0dfc609a6ccda16d7269e30710dc859d958bc6d791572a651c0a6c4c3a0ed4df1658f99be781e746799417065c6cb44e62d483d036cba48aa3ffb370f0b7
MD5 SHA1 SHA512

Submit Download