Analysis
-
max time kernel
52s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
26/03/2025, 00:03
General
-
Target
Desktop.rar
-
Size
2.0MB
-
MD5
aa234c8c2fc773698e649f4086be096a
-
SHA1
9c8bb067f7d06fed5e759efac36549ef11e50013
-
SHA256
86e21553a002c24c916b1839f7ddee160d381f8ef29525d08a3af2dbe779ba60
-
SHA512
5ec0cd27773978537c8b6f9c6e29b5286caeed87720e6fe8de853b98b34cca28d9cbb8e88be84f02bc38b961e3481d1b873ca5f805abdea5b24c559cb1e7810a
-
SSDEEP
49152:f+62U/uqc34u1UUP2tqclbtZKiPN2K8sfFAEY+dO/mEq9nvyS:b/u541UOtTlPPEDsNAE3O/mEqhvyS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Desktop.rar"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\net472\VMUnprotect.Dumper.exe"C:\Users\Admin\Desktop\net472\VMUnprotect.Dumper.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD58a0cff97f83483817fe61727ff3de7be
SHA185359a79acbd00872fce6c8905fe2d79388b7cb7
SHA25660add3505ae3d6908981a0dedb8c26aa55916b9e8e7d833ab005a0a6f9792baa
SHA51250c566e48e5ec4a9461e73dc38c8cff64747f5de3549cf453f77556ea3b220f33cd8eb69b62048a2f49c97c2cf574d645467caa1751eb1189c5b463779d0b417
-
Filesize
399KB
MD5c15853f6bf11818a4f8bf025723c44ba
SHA18434ed94020c1641be6121091d1ae91b118c887a
SHA256a378283378b2ca7a3e49e6a2694df7dfa301321a01b26aec658dc881892220e2
SHA51245de2e8935ff40f945fa62fa4a3821c094513a7208dca7a8387ef2c2720c2c56e49e29935f536abd2ee55259873231478495dbf37c6312e17d29cba17d88ab2d
-
Filesize
39KB
MD588e04b693f32034ebd0aed035a388938
SHA14984f8329d8a354ec83a4557cf0e128677bd5779
SHA2567fc351b4329315714d48ce5bb5462f92730612cf94aeb437bd705af6ae6595c4
SHA51279141d0231a479b10791c9f498fd5e43c96e27379dab6cc546fec08c7d019431d236b5db3b8f6a135b0958ce9e770fce9e3081ef5e32b5be2925b6f2fb86a3d4
-
Filesize
281KB
MD5a229cac73eaa3ab4cbe48ab389452d08
SHA1129e62ec48b24bb2d262b2c06b026782fc137d33
SHA25601f20926b84d7d9722ea7d32089dd1c66af677e6255ad32ff461b16d3392ee5c
SHA5125b645569f6c94fdd54745f9aaa3f95605513f8793ea0cfe8fb7fb751be33f8e149449f199f78bdf9c1842cfec379f47a72cdca5e8f293230cff8f15d1dced084
-
Filesize
46KB
MD5728772243d1612663afe962af61ff46f
SHA1598e33021ca17d240881804b39d4eb6782f874ec
SHA2569ad68c79de372403a1e3962e1d11453dff96a55e4f65ad6650e6d44525917627
SHA5120031023e089c8cbf12c36f7c6d01a910313c33caec69ab5dbf4e62eed675cc82c10fb5b02c1b3d52a80031c644fe4963ce82fa3e23a459eec03a1a9581f6ff6a
-
Filesize
65KB
MD5e2c1491d6641dd9f309f3ffb72821a9d
SHA16b858fca419771fbb2e05f3d40ba217ff5d9f1fe
SHA256286e54cb4ec66edf13ca92b71859756d9b022a2c6e97580f933b0dea61cc1dd2
SHA5121bc354bc0457f87cecfd6ad9d389d3a4c29b3c438548c383cb48ad7be438dc18c1615e268bd5c0656fe737f7337d4b22e00ba8ebcf818070b41a813e96a62841
-
Filesize
42KB
MD57d3d14b0417a68ccdd9c51972ff74863
SHA1ceacbd53b6a02e1f7337a6b0058924e1e11949bb
SHA25604113c8549185519f3202790ceb23df609644872b9c249a56d2bcf59566102c4
SHA512b2d133214f21d700e1af0c248dcc11ef66ea6da62043ff6d5e900fe2a1665d75583e4cd218526a146f2c62e22adf4ca2fa3b8879ae0f5a2e515e2c3a5184ce9c
-
Filesize
119KB
MD5d9cc6a1b4bc2ecd65d1477e7fbeec57f
SHA1d43a9f8aa4a907030b9bb92fe4ab6b545ec0e15e
SHA25610a744559365c191f8c24105eb11b69e683bc74feb5b9d800281b939cd540bf5
SHA5123043fddbd3c4aa9ef7ee51417490d14702ac7f8077a65ca99bd0d062abc9259f07ff56456dc084b4c557f24a8538176504c0bda1eaee36da970597364b265c67
-
Filesize
898B
MD56125abc7f954e38c0535d5edd8af06b0
SHA12ac93b2b5ac5a539f9bd49254f72b4bf07673036
SHA256a54473cd242fcaf7627739e0b525d7d5aaef4bc924939089d112195e73a74d99
SHA5124413e0c0295531c8fa294895b69d5feeee2bbb15566b573236f7a0a08465a21334bb0ca6dd85edb81189f94956599ed18f52f4fdd9e5d8a0ea96ee6de3c25f1b
-
Filesize
4KB
MD585a2548bd78532ec4be80fd54b3937ae
SHA1c47ce3c8dc0ddda4938b034d6d6ac323b6405e05
SHA25631d4d07cf2589ff36a3143e6e0d2b143b5156f1607ad239f15cbf62b6bd24f8f
SHA5125cd18fd87aa79d6d61244180d666b0bed02916910ed72ff767102d300a614d72884589e7ea294175bca7b3ec6aaa6b1223e62efcafbcd4c9e7c83b6f0962be32
-
Filesize
304KB
-
Filesize
424KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
128KB
-
Filesize
72KB
-
Filesize
88KB
-
Filesize
104KB
-
Filesize
8KB
-
Filesize
144KB
-
Filesize
1.5MB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
8KB