Analysis
-
max time kernel
182s -
max time network
294s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
27-09-2024 20:25
General
-
Target
LazyAIO/LazyAIO.exe
-
Size
14.0MB
-
MD5
912c7062ea2bcd72cfca56bda87bec61
-
SHA1
c7422d0ba5e3e191815bc23232591441b15dc6e8
-
SHA256
3cf5521e8fca62a2b14808f240766cf4ddcda830786457d24f1641e7c6ce9344
-
SHA512
9073e89b6711b06a7f98ab8bab5497921a8d04cdf5d3a3d176cbdd33c3e5e5069d3b071e669a23043d0954ff59592dff9781ce3f5cf58cb92e031d6a6f83fd95
-
SSDEEP
49152:j/T9XzcMurcgwdDpDzIysQimHDFz+bDSPgm3QeFmWWE1CC3Yur2+5aPPtKm9taTc:X9mtwi+1oYQymWFCCSHo65fX
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LazyAIO\LazyAIO.exe"C:\Users\Admin\AppData\Local\Temp\LazyAIO\LazyAIO.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 21522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3220 -ip 32201⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
14.0MB
-
Filesize
48KB
-
Filesize
920KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
24KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
24KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
112KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB