Analysis

  • max time kernel
    15s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    28/03/2025, 23:20

General

  • Target

    zapret-discord-youtube-main/bin/cygwin1.dll

  • Size

    2.8MB

  • MD5

    a1c82ed072dc079dd7851f82d9aa7678

  • SHA1

    52f26fa1aee39476f1c13438aec8bf969c78da45

  • SHA256

    103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b

  • SHA512

    22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59

  • SSDEEP

    49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\zapret-discord-youtube-main\bin\cygwin1.dll,#1
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2380-3-0x000007FEF5C70000-0x000007FEF5F72000-memory.dmp

    Filesize

    3.0MB

  • memory/2380-1-0x000007FEF5C70000-0x000007FEF5F72000-memory.dmp

    Filesize

    3.0MB

  • memory/2380-2-0x000007FEF5960000-0x000007FEF5C62000-memory.dmp

    Filesize

    3.0MB