Analysis
-
max time kernel
137s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
27-06-2024 22:06
General
-
Target
Frozen Spoofer/permunban.exe
-
Size
33.1MB
-
MD5
26a0ee034198a3163d7a4855dd246e63
-
SHA1
71fbd2e16a4c4ddaba065f8fd1d81e9f365f38a7
-
SHA256
28eae7cb4ab18555df3a1209513dffbfc27a8a098ad0b36754ac82eda131fd88
-
SHA512
88d1c582dbaca74d3b28541d465c2d678c594763e6098e327cc14a86da237e59b9444e18aac31da3e4b4fc77c8124363a66b64564dc40234a93d7b1fb18a9d04
-
SSDEEP
786432:5C1LbwgI7+I+w32BcdcfgEbZzIdUieRWacVqGiiihca:AYgI7GY2eGjbZzIheR/cVqGwh
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Frozen Spoofer\permunban.exe"C:\Users\Admin\AppData\Local\Temp\Frozen Spoofer\permunban.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3488-0-0x0000000074E5E000-0x0000000074E5F000-memory.dmpFilesize
4KB
-
memory/3488-1-0x0000000000380000-0x0000000002492000-memory.dmpFilesize
33.1MB
-
memory/3488-2-0x0000000074E50000-0x0000000075600000-memory.dmpFilesize
7.7MB
-
memory/3488-3-0x0000000007520000-0x0000000007AC4000-memory.dmpFilesize
5.6MB
-
memory/3488-4-0x0000000006EA0000-0x0000000006F32000-memory.dmpFilesize
584KB
-
memory/3488-5-0x0000000006F70000-0x0000000006FC8000-memory.dmpFilesize
352KB
-
memory/3488-6-0x0000000007370000-0x0000000007382000-memory.dmpFilesize
72KB
-
memory/3488-7-0x00000000074C0000-0x00000000074CA000-memory.dmpFilesize
40KB
-
memory/3488-8-0x00000000080A0000-0x0000000008476000-memory.dmpFilesize
3.8MB
-
memory/3488-9-0x0000000018EB0000-0x000000001AF98000-memory.dmpFilesize
32.9MB
-
memory/3488-10-0x0000000009230000-0x000000000926C000-memory.dmpFilesize
240KB
-
memory/3488-11-0x000000000A9D0000-0x000000000AA6C000-memory.dmpFilesize
624KB
-
memory/3488-12-0x0000000074E5E000-0x0000000074E5F000-memory.dmpFilesize
4KB
-
memory/3488-13-0x0000000074E50000-0x0000000075600000-memory.dmpFilesize
7.7MB