Analysis

  • max time kernel
    136s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-10-2024 00:22

General

  • Target

    NovaFixDll.exe

  • Size

    9.9MB

  • MD5

    29984a902def1bf58ff868b47d4787de

  • SHA1

    79dd496c5b6a7b83e206ae4dfd74b3cc44e50428

  • SHA256

    562afdb4e1c05b6ce4bb1dc7ed6fc7ef2772228b3df07b56cb34be04bb67e799

  • SHA512

    b73838e48232dc3ed363690298aac9fff5b8554cd3e993a0d93d95b5e3dc0a0c04c9b523fd3eeebb69a403f20ce0b34765e1bb09fd13ff7dddf6f2cbc4ee065e

  • SSDEEP

    98304:hS9YLqjMhhBG9uhHPymsT9c3Usft9ePUEsB2v/ZmEzL:U9YlhhBkE6N9c3Ust9ePtjZzL

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NovaFixDll.exe
    "C:\Users\Admin\AppData\Local\Temp\NovaFixDll.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4172
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\NovaFixDll.exe
      2⤵
      • Views/modifies file attributes
      PID:2736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads