dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178

Analysis

Target
dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe
Size 3.6MB
Sample200901-jncpm1snza
SHA256 dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178
MD5 7d31c3ed770b7dc88dfad5e2bde2f4b4
SHA1 bd2ffc537d3bb47c8007d6d7edb0f7727580884d
SHA512 6473668099bd43075a03ce6f7d69973ed75fbc99e9990195255b697e31725b2cd6a89ee7cd1c38930b4688f512ad7953ddf11fbfa1da9319cba60a0ace3faf89
MD5 SHA1 SHA512

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = d867d3ec5280d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	420	svchost.exe
Token: SeCreatePagefilePrivilege	420	svchost.exe
Token: SeDebugPrivilege	3888	dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3888	dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe
3888	dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 3516	3888	dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe	72
PID 3888 wrote to memory of 3516	3888	dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe	72
PID 3888 wrote to memory of 3516	3888	dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe	72

C:\Users\Admin\AppData\Local\Temp\dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe
"C:\Users\Admin\AppData\Local\Temp\dbbbb154dcc44afd21d46ac69120bac8ac97b51a824830e4abdacc5a2d676178.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd /c rd "C:\Windows\system32\drivers\etcDFcUC" /S /Q
  2⤵
  PID:3516