Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 03:46

General

  • Target

    ScreenCapture_Win8.WindowsLock2.exe

  • Size

    413KB

  • MD5

    faf666e0d80adbf3929a8bd78b34888a

  • SHA1

    eac5046cd25814f5c043c6b8a92a948f1572cd4e

  • SHA256

    bcdde1db8c7e73cda2baa87f7596767fb2783c40e1f3961eda2602528e15f2bc

  • SHA512

    337f4a41f8aade7a4144d116ae20e63dc3df2e290096b3de8087188f21e3b7be9bffbc040be855bed509e080192720176e7d50fcb6f174a528da6ee48c77aa2d

  • SSDEEP

    12288:5V+t1nfILUvE45vvck5+TCxVCny2u8Am:5VM1nvs45vvjsYUy25

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ScreenCapture_Win8.WindowsLock2.exe
    "C:\Users\Admin\AppData\Local\Temp\ScreenCapture_Win8.WindowsLock2.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1940-0-0x000007FEF5463000-0x000007FEF5464000-memory.dmp

    Filesize

    4KB

  • memory/1940-1-0x00000000001D0000-0x000000000023E000-memory.dmp

    Filesize

    440KB

  • memory/1940-2-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

    Filesize

    9.9MB

  • memory/1940-3-0x000007FEF5463000-0x000007FEF5464000-memory.dmp

    Filesize

    4KB

  • memory/1940-4-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

    Filesize

    9.9MB