c40d429384eb11ba9fd427c485c7c22f484eaa5fe7b2136204967d717013aa77 | Triage

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 20:37

Sharing

Report Analysis Logs

General

Target

OmenMon.exe
Size

481KB
MD5

161f176c8f9e6a622a357989add6e2ee
SHA1

ae9137537cfe6b8f913d31d13228fc5cb96d1228
SHA256

c40d429384eb11ba9fd427c485c7c22f484eaa5fe7b2136204967d717013aa77
SHA512

be23e2a0f6420f4ec0151d1e8e7e9a8dc0b90a630913d60fcd847497a929323200866acb7dce98873d5592922231bdcc2814f3ea42f2e24abf1912235b3c3b9c
SSDEEP

12288:TuetjK1ZFEZPvrT5Mdfe44444QJaDhFqvo7:TPtjKhEZPvrTc3d

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	OmenMon.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	OmenMon.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3048	OmenMon.exe

C:\Users\Admin\AppData\Local\Temp\OmenMon.exe
"C:\Users\Admin\AppData\Local\Temp\OmenMon.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-0-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmp

Filesize
4KB

Download
memory/3048-1-0x000000013FD00000-0x000000013FD7A000-memory.dmp

Filesize
488KB

Download
memory/3048-2-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/3048-3-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download