Analysis
-
max time kernel
1472s -
max time network
1485s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
03-11-2024 00:53
General
-
Target
SHADOW BP + HAX 3.4/BYPASS/Release/txn54kjdcy1#SHADOW VIP.exe
-
Size
230KB
-
MD5
2d2ca33078e6807ab0902ed64e34f98c
-
SHA1
36fd412c197dc0711638a135aacf5cb4cb2813dd
-
SHA256
0bd369a51028a3ae0b919cd30313ba30d28e5e0b3f93604a7769876b41c0c91e
-
SHA512
40a93950d5614b2a5fbd08061970fe0e885e9013d998b18a432dcc6dccba4ced514e4c4082a424d1c09da4867ec7852ef204421df642b9b89e012ee84e5c05d1
-
SSDEEP
1536:cxzcWu3TCyTpttkvbMPm7mJVldBuDjLRlVaQlm7wVcl:cVc53T9TptQbMgqVldMLRlVaQlm7qY
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SHADOW BP + HAX 3.4\BYPASS\Release\txn54kjdcy1#SHADOW VIP.exe"C:\Users\Admin\AppData\Local\Temp\SHADOW BP + HAX 3.4\BYPASS\Release\txn54kjdcy1#SHADOW VIP.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB