Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
11-07-2024 20:42
Behavioral task
behavioral1
Sample
playit.exe
Resource
win7-20240704-en
windows7-x64
7 signatures
150 seconds
General
-
Target
playit.exe
-
Size
202KB
-
MD5
96922ff790264130780d92489a232eb0
-
SHA1
c75d43dbb381650ec0a9684867b968bf658a0304
-
SHA256
a4aa9acf04e3377f7d0fd23f0677e29cf885436ee18af02de049899a9ab62d61
-
SHA512
0e50f48171d151aca6006f158be6d08985c62e915a5ec46fa9e9e1dc18c38112b4261209158826b15a0c48e05ac26a5af87628e6b57212c0590f962a7a06809d
-
SSDEEP
3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIRpPl1W4F0MpeCWBxwEJcA:QLV6Bta6dtJmakIM56lY4yMpeCoxwEx
Malware Config
Signatures
-
Processes:
playit.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA playit.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
playit.exepid process 624 playit.exe 624 playit.exe 624 playit.exe 624 playit.exe 624 playit.exe 624 playit.exe 624 playit.exe 624 playit.exe 624 playit.exe 624 playit.exe 624 playit.exe 624 playit.exe 624 playit.exe 624 playit.exe 624 playit.exe 624 playit.exe 624 playit.exe 624 playit.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
playit.exepid process 624 playit.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
playit.exedescription pid process Token: SeDebugPrivilege 624 playit.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/624-0-0x0000000074D82000-0x0000000074D83000-memory.dmpFilesize
4KB
-
memory/624-1-0x0000000074D80000-0x0000000075331000-memory.dmpFilesize
5.7MB
-
memory/624-2-0x0000000074D80000-0x0000000075331000-memory.dmpFilesize
5.7MB
-
memory/624-4-0x0000000074D80000-0x0000000075331000-memory.dmpFilesize
5.7MB
-
memory/624-8-0x0000000074D82000-0x0000000074D83000-memory.dmpFilesize
4KB
-
memory/624-9-0x0000000074D80000-0x0000000075331000-memory.dmpFilesize
5.7MB
-
memory/624-10-0x0000000074D80000-0x0000000075331000-memory.dmpFilesize
5.7MB