dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178

Analysis

Target
dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe
Size 3.6MB
Sample200901-jncpm1snza
SHA256 dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178
MD5 7d31c3ed770b7dc88dfad5e2bde2f4b4
SHA1 bd2ffc537d3bb47c8007d6d7edb0f7727580884d
SHA512 6473668099bd43075a03ce6f7d69973ed75fbc99e9990195255b697e31725b2cd6a89ee7cd1c38930b4688f512ad7953ddf11fbfa1da9319cba60a0ace3faf89
MD5 SHA1 SHA512

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1032	dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe
1032	dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 764	1032	dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe	25
PID 1032 wrote to memory of 764	1032	dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe	25
PID 1032 wrote to memory of 764	1032	dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe	25
PID 1032 wrote to memory of 764	1032	dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe	25

C:\Users\Admin\AppData\Local\Temp\dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe
"C:\Users\Admin\AppData\Local\Temp\dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd /c rd "C:\Windows\system32\drivers\etcagXLr" /S /Q
  2⤵
  PID:764