Resubmissions
08/08/2024, 14:08
240808-rfx2zayake408/08/2024, 14:06
240808-reqw9svaqj308/08/2024, 14:03
240808-rc4eksxhpc4Analysis
- max time kernel
72s - max time network
22s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system - submitted
08/08/2024, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Void server boost/void server boost.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral2
Sample
Void server boost/void server boost.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
300 seconds
General
- Target Void server boost/void server boost.exe
- Size 1.0MB
- Sample240808-reqw9svaqj
- SHA256 a18628e8080b21bf266abf4f571063abba2207ac2d999993541a0f49176b4801
- MD5 ce1c66fbc99abd29ad81c5d064e0f966
- SHA1 72394086d1916da3697e8513672e09f59a1ff907
- SHA512 fca61fcb62742b33b46f7d6e73bcb6f0d841f7b96845e0578a36541945e7ada2eeefc812d698093935aa0809518178f764e0d04bcf889031abea4fd1f0f9621a
- SSDEEP 24576:njih34xvK2EW2rLZHSIa6agTRpnnJMOr2I7cimoi1Cu:nO34xyD9L9LagThXr2+Vm
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1276 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1276 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe 1276 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Void server boost\void server boost.exe"C:\Users\Admin\AppData\Local\Temp\Void server boost\void server boost.exe"1⤵PID:2608
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1276
-
C:\Users\Admin\AppData\Local\Temp\Void server boost\void server boost.exe"C:\Users\Admin\AppData\Local\Temp\Void server boost\void server boost.exe"1⤵PID:2884