Analysis
-
max time kernel
51s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 18:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
noclick.exe
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
noclick.exe
Resource
win10v2004-20240611-en
4 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
noclick.exe
-
Size
137KB
-
MD5
66a6b7cbea8224b95d218f2a350a672d
-
SHA1
ac827fc12a64b6728c2a68bee125439904dc9d5e
-
SHA256
4c33cafb4c0fb2d93417bfadd870f7b12d2bcf0a1cc2454aeba8a26e69af7649
-
SHA512
61deeb7b08c7e9a1d0405043106ec8ce19119719147f8d55bc990f10cddd0aa3d87ef9744fefc19ab16b5e0234f5f708f21f3a6e8fa550f6f71dbc27003e18ac
-
SSDEEP
1536:68mAkOs/WhP1f4/VgzgWHNPJ0BvWhvqM5zmQd3vyL3+rMPAruINeTbLLRAst3lYq:67lD+x1f4/YgBWs5iu7bLxX
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
shutdown.exedescription pid process Token: SeShutdownPrivilege 3916 shutdown.exe Token: SeRemoteShutdownPrivilege 3916 shutdown.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
noclick.execmd.exedescription pid process target process PID 2928 wrote to memory of 3908 2928 noclick.exe cmd.exe PID 2928 wrote to memory of 3908 2928 noclick.exe cmd.exe PID 2928 wrote to memory of 3908 2928 noclick.exe cmd.exe PID 3908 wrote to memory of 3916 3908 cmd.exe shutdown.exe PID 3908 wrote to memory of 3916 3908 cmd.exe shutdown.exe PID 3908 wrote to memory of 3916 3908 cmd.exe shutdown.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\noclick.exe"C:\Users\Admin\AppData\Local\Temp\noclick.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c shutdown /r /c HAHA2⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\system32\shutdown.exeshutdown /r /c HAHA3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:4088
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2540