Analysis
- max time kernel
95s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
06/10/2024, 21:36
General
- Target NeverLoseCrack-main/NeverLoseCracked [no cap].exe
- Size 116KB
- Sample241006-1fx7ea1epa
- SHA256 7a85dce7ea5b93ff36d117de8dadc113f050f5dabb76c363ada52727f0846f34
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NeverLoseCrack-main\NeverLoseCracked [no cap].exe"C:\Users\Admin\AppData\Local\Temp\NeverLoseCrack-main\NeverLoseCracked [no cap].exe"1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2868-0-0x00007FFCCA6B3000-0x00007FFCCA6B5000-memory.dmp
memory/2868-1-0x00000142C7E00000-0x00000142C7E22000-memory.dmp
memory/2868-2-0x00007FFCCA6B0000-0x00007FFCCB171000-memory.dmp
memory/2868-5-0x00007FFCCA6B0000-0x00007FFCCB171000-memory.dmp
memory/2868-6-0x00007FFCCA6B0000-0x00007FFCCB171000-memory.dmp
memory/2868-7-0x00007FFCCA6B0000-0x00007FFCCB171000-memory.dmp
memory/2868-81-0x00007FFCCA6B3000-0x00007FFCCA6B5000-memory.dmp
memory/2868-82-0x00007FFCCA6B0000-0x00007FFCCB171000-memory.dmp
memory/2868-83-0x00007FFCCA6B0000-0x00007FFCCB171000-memory.dmp
memory/2868-84-0x00007FFCCA6B0000-0x00007FFCCB171000-memory.dmp
memory/2868-85-0x00007FFCCA6B0000-0x00007FFCCB171000-memory.dmp