Analysis

  • max time kernel
    51s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 18:07

Errors

Reason
Machine shutdown

General

  • Target

    noclick.exe

  • Size

    137KB

  • MD5

    66a6b7cbea8224b95d218f2a350a672d

  • SHA1

    ac827fc12a64b6728c2a68bee125439904dc9d5e

  • SHA256

    4c33cafb4c0fb2d93417bfadd870f7b12d2bcf0a1cc2454aeba8a26e69af7649

  • SHA512

    61deeb7b08c7e9a1d0405043106ec8ce19119719147f8d55bc990f10cddd0aa3d87ef9744fefc19ab16b5e0234f5f708f21f3a6e8fa550f6f71dbc27003e18ac

  • SSDEEP

    1536:68mAkOs/WhP1f4/VgzgWHNPJ0BvWhvqM5zmQd3vyL3+rMPAruINeTbLLRAst3lYq:67lD+x1f4/YgBWs5iu7bLxX

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\noclick.exe
    "C:\Users\Admin\AppData\Local\Temp\noclick.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2928
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c shutdown /r /c HAHA
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3908
      • C:\Windows\system32\shutdown.exe
        shutdown /r /c HAHA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3916
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:4088
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:2540

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2540-3-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

        Filesize

        4KB

      • memory/2928-0-0x000000013FAC0000-0x000000013FAE4000-memory.dmp

        Filesize

        144KB

      • memory/2928-1-0x000000013FAC0000-0x000000013FAE4000-memory.dmp

        Filesize

        144KB

      • memory/4088-2-0x0000000002E10000-0x0000000002E11000-memory.dmp

        Filesize

        4KB