Analysis

  • max time kernel
    91s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/12/2024, 18:47

General

  • Target

    SHREDDER AIO TOOL.exe

  • Size

    19.8MB

  • MD5

    e0cf0457dac4e4acbdb265640c310270

  • SHA1

    06bc3b50f8b74537f41e8f0401af339a125ded12

  • SHA256

    3ca75f1ed33faeb3816c489498e8aa81d3180ab241378c5fbf42e66fadd0bfa0

  • SHA512

    cd3e46ff692dddbd1538745328d07a6c777a82af5bdbb3685bfc203755028e011671bd7655480e6e871a6e174ec582eb47ee00cd5c1da81e1b58a07f0a29c7f9

  • SSDEEP

    393216:6J5iiX1Wk0Hhnbzsv3e7sCdFVAXMSnKmA6a20fchaHUR:EllB0ZsvO7sCvg3a20fcBR

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SHREDDER AIO TOOL.exe
    "C:\Users\Admin\AppData\Local\Temp\SHREDDER AIO TOOL.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    PID:3420
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x304 0x4a0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Web\Wallpaper\click.wav

    Filesize

    6KB

    MD5

    be1a290e146ab2237b50c85756a46cc5

    SHA1

    59f000a9c1c5f691c7c44f6ea0e0e8fa2b38d0f2

    SHA256

    c5dfc83f5729847ac52f3c18658674589ea6f0a8b4c80a044749e0fdedd5f3b8

    SHA512

    07772297d8abd5f8b873af3d05f9ab147c0b17fe105bd9a9188bfbc7d219556e401372bcde5467ef7f9211ba4ec3b53b078db61262ae25d838416e66662eb512

  • memory/3420-0-0x00007FF81EA33000-0x00007FF81EA35000-memory.dmp

    Filesize

    8KB

  • memory/3420-1-0x000001C3B5070000-0x000001C3B6436000-memory.dmp

    Filesize

    19.8MB

  • memory/3420-2-0x00007FF81EA30000-0x00007FF81F4F1000-memory.dmp

    Filesize

    10.8MB

  • memory/3420-3-0x000001C3D2950000-0x000001C3D5046000-memory.dmp

    Filesize

    39.0MB

  • memory/3420-4-0x000001C3D0C60000-0x000001C3D0DAE000-memory.dmp

    Filesize

    1.3MB

  • memory/3420-5-0x000001C3B8190000-0x000001C3B81A4000-memory.dmp

    Filesize

    80KB

  • memory/3420-8-0x00007FF81EA30000-0x00007FF81F4F1000-memory.dmp

    Filesize

    10.8MB

  • memory/3420-9-0x00007FF81EA33000-0x00007FF81EA35000-memory.dmp

    Filesize

    8KB

  • memory/3420-11-0x00007FF81EA30000-0x00007FF81F4F1000-memory.dmp

    Filesize

    10.8MB

  • memory/3420-21-0x00007FF81EA30000-0x00007FF81F4F1000-memory.dmp

    Filesize

    10.8MB