aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938

General

Target

aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe
Size

994KB
MD5

0cefce0dbbbedc5eb1febe4d85b23c71
SHA1

6aef7d5a462268c438c8417ee0da3f130b8aa84a
SHA256

aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938
SHA512

1311cf0b918419c192b3914a01e467430f445aaf6a003338e2176b1527c74263f658d8d39bd6d9c78b70324615101026767034798945d42d25215ee4d45654bf

Score

8^/10

Executes dropped EXE 2 IoCs

pid	Process
1980	cfhiyme.exe
2448	cfhiyme.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\cfhiyme.exe.log	cfhiyme.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2796 set thread context of 588	2796	aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe	69
PID 1980 set thread context of 2448	1980	cfhiyme.exe	71

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
588	aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe
588	aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe
2448	cfhiyme.exe
2448	cfhiyme.exe
2448	cfhiyme.exe
2448	cfhiyme.exe
2448	cfhiyme.exe
2448	cfhiyme.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	cfhiyme.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3356	2796	aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe	68
PID 2796 wrote to memory of 3356	2796	aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe	68
PID 2796 wrote to memory of 3356	2796	aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe	68
PID 2796 wrote to memory of 588	2796	aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe	69
PID 2796 wrote to memory of 588	2796	aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe	69
PID 2796 wrote to memory of 588	2796	aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe	69
PID 2796 wrote to memory of 588	2796	aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe	69
PID 2796 wrote to memory of 588	2796	aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe	69
PID 2796 wrote to memory of 588	2796	aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe	69
PID 2796 wrote to memory of 588	2796	aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe	69
PID 1980 wrote to memory of 2448	1980	cfhiyme.exe	71
PID 1980 wrote to memory of 2448	1980	cfhiyme.exe	71
PID 1980 wrote to memory of 2448	1980	cfhiyme.exe	71
PID 1980 wrote to memory of 2448	1980	cfhiyme.exe	71
PID 1980 wrote to memory of 2448	1980	cfhiyme.exe	71
PID 1980 wrote to memory of 2448	1980	cfhiyme.exe	71
PID 1980 wrote to memory of 2448	1980	cfhiyme.exe	71
PID 2448 wrote to memory of 724	2448	cfhiyme.exe	8

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:724

C:\Users\Admin\AppData\Local\Temp\aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe
"C:\Users\Admin\AppData\Local\Temp\aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe
  "C:\Users\Admin\AppData\Local\Temp\aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe"
  2⤵
  PID:3356
- C:\Users\Admin\AppData\Local\Temp\aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe
  "C:\Users\Admin\AppData\Local\Temp\aaf1c2e67e9049fcbfd9f97302d78837769e1ad20fb2c4f35c69339e95845938.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:588

memory/588-116-0x0000000000EA0000-0x00000000010BA000-memory.dmp

Filesize
2.1MB

Download
memory/588-117-0x00000000010C0000-0x000000000130B000-memory.dmp

Filesize
2.3MB

Download
memory/588-120-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/724-125-0x0000000031C00000-0x0000000031C77000-memory.dmp

Filesize
476KB

Download
memory/1980-121-0x0000000001240000-0x0000000001241000-memory.dmp

Filesize
4KB

Download
memory/2448-124-0x00000000018A0000-0x0000000001AEB000-memory.dmp

Filesize
2.3MB

Download
memory/2796-115-0x0000000003070000-0x0000000003071000-memory.dmp

Filesize
4KB

Download