Analysis

  • max time kernel
    443s
  • max time network
    444s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    15/01/2025, 21:56

General

  • Target

    Ez.exe

  • Size

    201KB

  • MD5

    729780e8774dafaaa73bd95c4f8b1343

  • SHA1

    8b7e3093ef3a7d888e4fe6fb53d8b599fd538897

  • SHA256

    2ddc3ef48bbb4b8c90b48d35665832478b7c434a2ee58e0b3fd69058fe63c952

  • SHA512

    366544893a88ef18ba63c74ecfe67d2929365b541c1fcdb8ad905d792014486ed8b8ce4548cd0c2b0e15cbc5f0d04ff3402d63438f08a582aae07962762bedaf

  • SSDEEP

    3072:dlpy4+9pmTN+XCJ4YAcgX/+y5bep5YxclZGJZZaD0VljHJHPCD8Utm:dImTN+kAdjxep5YxcGJzaQTHPCDm

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ez.exe
    "C:\Users\Admin\AppData\Local\Temp\Ez.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1632
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4c8 0x2fc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2852

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1632-0-0x0000000074652000-0x0000000074653000-memory.dmp

          Filesize

          4KB

        • memory/1632-1-0x0000000074650000-0x0000000074C01000-memory.dmp

          Filesize

          5.7MB

        • memory/1632-2-0x0000000074650000-0x0000000074C01000-memory.dmp

          Filesize

          5.7MB

        • memory/1632-3-0x0000000074650000-0x0000000074C01000-memory.dmp

          Filesize

          5.7MB

        • memory/1632-4-0x0000000074650000-0x0000000074C01000-memory.dmp

          Filesize

          5.7MB

        • memory/1632-5-0x0000000074652000-0x0000000074653000-memory.dmp

          Filesize

          4KB

        • memory/1632-6-0x0000000074650000-0x0000000074C01000-memory.dmp

          Filesize

          5.7MB

        • memory/1632-7-0x0000000074650000-0x0000000074C01000-memory.dmp

          Filesize

          5.7MB

        • memory/1632-12-0x0000000074650000-0x0000000074C01000-memory.dmp

          Filesize

          5.7MB