078f883c1bcf8d0f9d5eb75f2dcc849564bb7e3fee851df036acb2e6870e95c1

Analysis

Target
078f883c1bcf8d0f9d5eb75f2dcc849564bb7e3fee851df036acb2e6870e95c1.exe
Size 3.3MB
Sample200904-3ygp2eqsrn
SHA256 078f883c1bcf8d0f9d5eb75f2dcc849564bb7e3fee851df036acb2e6870e95c1
MD5 b2425f64492f99241646dc518ca34cab
SHA1 fd273a647b45bfecfe42187b8c221b2fe2bee543
SHA512 4b1bca3f8b5b57aa5f0f4ba9c80ba40640c936b6660a92bcf1c2783dec51bb8f572bab5c7eff570d4458b4097bd592ac86d2992c625f7fa620583b351ad5cd86
MD5 SHA1 SHA512

Score

7^/10

Loads dropped DLL 4 IoCs

pid	Process
3044	078f883c1bcf8d0f9d5eb75f2dcc849564bb7e3fee851df036acb2e6870e95c1.exe
3044	078f883c1bcf8d0f9d5eb75f2dcc849564bb7e3fee851df036acb2e6870e95c1.exe
3044	078f883c1bcf8d0f9d5eb75f2dcc849564bb7e3fee851df036acb2e6870e95c1.exe
3044	078f883c1bcf8d0f9d5eb75f2dcc849564bb7e3fee851df036acb2e6870e95c1.exe

JavaScript code in executable 2 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ad42-2.dat	js
behavioral2/files/0x000100000001ad42-3.dat	js

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 442b02cec982d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1232	svchost.exe
Token: SeCreatePagefilePrivilege	1232	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 500 wrote to memory of 3044	500	078f883c1bcf8d0f9d5eb75f2dcc849564bb7e3fee851df036acb2e6870e95c1.exe	73
PID 500 wrote to memory of 3044	500	078f883c1bcf8d0f9d5eb75f2dcc849564bb7e3fee851df036acb2e6870e95c1.exe	73
PID 500 wrote to memory of 3044	500	078f883c1bcf8d0f9d5eb75f2dcc849564bb7e3fee851df036acb2e6870e95c1.exe	73

C:\Users\Admin\AppData\Local\Temp\078f883c1bcf8d0f9d5eb75f2dcc849564bb7e3fee851df036acb2e6870e95c1.exe
"C:\Users\Admin\AppData\Local\Temp\078f883c1bcf8d0f9d5eb75f2dcc849564bb7e3fee851df036acb2e6870e95c1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:500
- C:\Users\Admin\AppData\Local\Temp\078f883c1bcf8d0f9d5eb75f2dcc849564bb7e3fee851df036acb2e6870e95c1.exe
  "C:\Users\Admin\AppData\Local\Temp\078f883c1bcf8d0f9d5eb75f2dcc849564bb7e3fee851df036acb2e6870e95c1.exe"
  2⤵
  - Loads dropped DLL
  PID:3044