Analysis
-
max time kernel
118s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
11/07/2024, 21:55
General
-
Target
playit.exe
-
Size
202KB
-
MD5
96922ff790264130780d92489a232eb0
-
SHA1
c75d43dbb381650ec0a9684867b968bf658a0304
-
SHA256
a4aa9acf04e3377f7d0fd23f0677e29cf885436ee18af02de049899a9ab62d61
-
SHA512
0e50f48171d151aca6006f158be6d08985c62e915a5ec46fa9e9e1dc18c38112b4261209158826b15a0c48e05ac26a5af87628e6b57212c0590f962a7a06809d
-
SSDEEP
3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIRpPl1W4F0MpeCWBxwEJcA:QLV6Bta6dtJmakIM56lY4yMpeCoxwEx
Score
10/10
Malware Config
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\playit.exe"C:\Users\Admin\AppData\Local\Temp\playit.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB