Analysis

  • max time kernel
    7s
  • max time network
    5s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/08/2024, 10:29

General

  • Target

    Loader-Perm_cracked (1).exe

  • Size

    1.4MB

  • MD5

    efacb1e93320bd7c040f0e6ca441d0b1

  • SHA1

    6c2c284d18004ae770f9cac28c67803fad5c846c

  • SHA256

    1227c66dd0ecd15e4a37aec1864cf9b1e4bf80edad58c6d15124d19756a94b77

  • SHA512

    29c770beba6bd0b5145deaef54ea9c097c5a07baea7362ad76948af0831f0416d044b797419ae77670cfc341f54651b10fc8f982953d440a9a2b1130be4c08ea

  • SSDEEP

    24576:E6qsgabtl9Z8Nx6AQ8DSoRPm/Rwn4o60OegX7Aozptl72NkoV:is9bngNzv+DenO0Ervzd2Nkw

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Loader-Perm_cracked (1).exe
    "C:\Users\Admin\AppData\Local\Temp\Loader-Perm_cracked (1).exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader-Perm_cracked (1).exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Loader-Perm_cracked (1).exe" MD5
        3⤵
          PID:4028
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:3704
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:3232

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads