4aafc1b7c7ac7d6e1f5a7c0da9b617e680afc65f60c0925d7ce7393699def7c9

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

New folder/newuimatrix.exe
Size

1.0MB
MD5

4a6eb12ea7764c04fdfed398f0a95828
SHA1

804fdf55cf5da526e2c26bd7aed9f40fb3507470
SHA256

e7687d570f1dcbb97c9bc188c79ea94662cdd12335400f73080321cc8dbec63d
SHA512

5668695f9db4eacba7c12f6bc0ae732d74d5fb78adbd00b7bcef2116c1adbddc344ed42d88995ce5ee8230991426406180354a8da406ea69f1e8ffc1057ded3b
SSDEEP

24576:2XpuTMw5YMIMkbpIqekZbCGASk9m7qDKu5bwe4gOn24O:2XuMwaMopIAZtJk92qDKuEgOn24O

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2080	newuimatrix.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2080	newuimatrix.exe
2080	newuimatrix.exe
2080	newuimatrix.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	newuimatrix.exe
Token: SeDebugPrivilege	2080	newuimatrix.exe
Token: SeLoadDriverPrivilege	2080	newuimatrix.exe
Token: SeShutdownPrivilege	1228	Process not Found
Token: SeShutdownPrivilege	1228	Process not Found
Token: SeShutdownPrivilege	1228	Process not Found
Token: SeShutdownPrivilege	1228	Process not Found
Token: SeShutdownPrivilege	1228	Process not Found
Token: SeShutdownPrivilege	1228	Process not Found

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1228	Process not Found

C:\Users\Admin\AppData\Local\Temp\New folder\newuimatrix.exe
"C:\Users\Admin\AppData\Local\Temp\New folder\newuimatrix.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-50-0x000000013F2C0000-0x000000013F47C000-memory.dmp

Filesize
1.7MB

Download
memory/2080-22-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2080-18-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-12-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-33-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-49-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-48-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-10-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-47-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2080-26-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2080-16-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-8-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-20-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-0-0x000000013F2C0000-0x000000013F47C000-memory.dmp

Filesize
1.7MB

Download
memory/2080-14-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-4-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-6-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-31-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-27-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-1-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-51-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download
memory/2080-54-0x000000013F2C0000-0x000000013F47C000-memory.dmp

Filesize
1.7MB

Download
memory/2080-55-0x0000000004070000-0x0000000004CFA000-memory.dmp

Filesize
12.5MB

Download