Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 14:59
Behavioral task
behavioral1
Sample
EFfI.exe
Resource
win7-20240220-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
EFfI.exe
Resource
win10v2004-20240508-en
4 signatures
150 seconds
General
-
Target
EFfI.exe
-
Size
2.8MB
-
MD5
05529268a2eb991158ed884bd7a76b7f
-
SHA1
16320aac38b85c5decaa1749e074dc81fc77e270
-
SHA256
5443154f35416456b568138d9a687c4aeb39acc5055e4ac0c1b1644f68547972
-
SHA512
d533eecf50514a30135e023ce18749addf62dcb0a84a6606ae479a403ef515b75010871ef76d44de58d84b62c97a98a2d0c0bbd272c4784fb8d42753ec66b5c9
-
SSDEEP
49152:i4QYv863cveVpl2Ndss8x8FihEE92oiSfy0txKc6d33opNVRcRkQnnNO/i:4TxvedWdt89GEo+y0txKc6ypqR/nnU/i
Score
7/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/5036-0-0x0000000000400000-0x00000000009DC000-memory.dmp vmprotect behavioral2/memory/5036-2-0x0000000000400000-0x00000000009DC000-memory.dmp vmprotect behavioral2/memory/5036-5-0x0000000000400000-0x00000000009DC000-memory.dmp vmprotect behavioral2/memory/5036-7-0x0000000000400000-0x00000000009DC000-memory.dmp vmprotect behavioral2/memory/5036-8-0x0000000000400000-0x00000000009DC000-memory.dmp vmprotect behavioral2/memory/5036-9-0x0000000000400000-0x00000000009DC000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
EFfI.exepid process 5036 EFfI.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
EFfI.exepid process 5036 EFfI.exe 5036 EFfI.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
EFfI.exepid process 5036 EFfI.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5036-0-0x0000000000400000-0x00000000009DC000-memory.dmpFilesize
5.9MB
-
memory/5036-1-0x0000000000401000-0x0000000000488000-memory.dmpFilesize
540KB
-
memory/5036-2-0x0000000000400000-0x00000000009DC000-memory.dmpFilesize
5.9MB
-
memory/5036-5-0x0000000000400000-0x00000000009DC000-memory.dmpFilesize
5.9MB
-
memory/5036-7-0x0000000000400000-0x00000000009DC000-memory.dmpFilesize
5.9MB
-
memory/5036-8-0x0000000000400000-0x00000000009DC000-memory.dmpFilesize
5.9MB
-
memory/5036-9-0x0000000000400000-0x00000000009DC000-memory.dmpFilesize
5.9MB