Analysis

  • max time kernel
    94s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-01-2025 18:57

General

  • Target

    OneclickTools/OOshutup10/OOSU10.exe

  • Size

    1.9MB

  • MD5

    4803e06db91fdb8b6d1b65c0010d2f87

  • SHA1

    f6d68a7dcc9c46e663f586341e8ba8d1be6b0f9c

  • SHA256

    beb7becc38ccc7ed37c47fe607b25a966a5f71aabd36ab945c3cba15451dfa7b

  • SHA512

    f34195e4dd2b9a0dc4847e94547b3b4f0ee13009878f0e88954e6a070234b902814a7bdc018782cbaddb52e31e19f30bc2273d1b2ed1071f0695563e070c58c6

  • SSDEEP

    49152:zE6D5EyNuGVUJEJTJxJROfOrV3rukAanKZCWumEjlGLsmt8MR+zh:TykAWKZCfmMMR+l

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OneclickTools\OOshutup10\OOSU10.exe
    "C:\Users\Admin\AppData\Local\Temp\OneclickTools\OOshutup10\OOSU10.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2492-0-0x00007FFD0AF03000-0x00007FFD0AF05000-memory.dmp

    Filesize

    8KB

  • memory/2492-1-0x0000022A5EF70000-0x0000022A5F160000-memory.dmp

    Filesize

    1.9MB

  • memory/2492-2-0x0000022A5F5A0000-0x0000022A5F5CC000-memory.dmp

    Filesize

    176KB

  • memory/2492-3-0x0000022A60DE0000-0x0000022A60E86000-memory.dmp

    Filesize

    664KB

  • memory/2492-4-0x00007FFD0AF00000-0x00007FFD0B9C1000-memory.dmp

    Filesize

    10.8MB

  • memory/2492-5-0x0000022A5F5D0000-0x0000022A5F5EA000-memory.dmp

    Filesize

    104KB

  • memory/2492-6-0x0000022A7AFE0000-0x0000022A7B09A000-memory.dmp

    Filesize

    744KB

  • memory/2492-7-0x0000022A796B0000-0x0000022A796B8000-memory.dmp

    Filesize

    32KB

  • memory/2492-9-0x0000022A7D3C0000-0x0000022A7D3F8000-memory.dmp

    Filesize

    224KB

  • memory/2492-10-0x0000022A79720000-0x0000022A7972E000-memory.dmp

    Filesize

    56KB

  • memory/2492-11-0x00007FFD0AF00000-0x00007FFD0B9C1000-memory.dmp

    Filesize

    10.8MB

  • memory/2492-12-0x00007FFD0AF00000-0x00007FFD0B9C1000-memory.dmp

    Filesize

    10.8MB

  • memory/2492-13-0x00007FFD0AF00000-0x00007FFD0B9C1000-memory.dmp

    Filesize

    10.8MB

  • memory/2492-16-0x00007FFD0AF03000-0x00007FFD0AF05000-memory.dmp

    Filesize

    8KB

  • memory/2492-17-0x00007FFD0AF00000-0x00007FFD0B9C1000-memory.dmp

    Filesize

    10.8MB