Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 00:54
Static task
static1
Behavioral task
behavioral1
Sample
60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe
Resource
win7-20240611-en
General
-
Target
60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe
-
Size
1.3MB
-
MD5
170639b71e099423644d4c6210b3f366
-
SHA1
dcbbc9708cffbbf0da0f06d8ceeb2619a0ca37f6
-
SHA256
60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193
-
SHA512
d32b3bc58e5f48125922eee378a458851c7b7ddeed86ad2c604d861f23d610457b6594171c171f206dee5223ac5a03c9c9517b43f2bee92b9508b4971680a7a2
-
SSDEEP
24576:PscFvtuIKsMyxsPS+XR+5QIFSfOUaay0Sh9wQcRHW/nSy2KQ77CxZbmNrU5j11NP:b8O9+h+5bSjrA9lcR2/SLT7CxZSg5jTu
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
Processes:
60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exepid process 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exepid process 2384 60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe"C:\Users\Admin\AppData\Local\Temp\60bcb7b7bfbcd3801cc7a534a1aee14ffd46d3f8f81738578f3730daf4c8d193.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2384
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2384-0-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-2-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-1-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-4-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-5-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-6-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-7-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-8-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-9-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-10-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-11-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-12-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-13-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-14-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-15-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-16-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-17-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB
-
memory/2384-18-0x00000000013A0000-0x00000000018D2000-memory.dmpFilesize
5.2MB