08d215fd35494280e6397e8bc527bd6de64eb78a73acd3bd07a01da376ed4cb7

Resubmissions

07-02-2022 00:34

Target

1_cr.exe
Size

847KB
MD5

af067a53dcecb2f527a351a6491c56b9
SHA1

845f59d0324b2577979b51a8e66689f6f604ecde
SHA256

9cc9a90e31f1486a991360c25209f1b08aec5bd7e084de748e73ebef6deca38d
SHA512

e9cc332f2108be20acbdafe91a6ee8d489eddb05b752a05d5372a468ea6c95215ca06fb0881b49fc20fac9f0d602a665272b70997df4414ea98a016f60e4fd71

Score

4^/10

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2044	svchost.exe
Token: SeCreatePagefilePrivilege	2044	svchost.exe
Token: SeShutdownPrivilege	2044	svchost.exe
Token: SeCreatePagefilePrivilege	2044	svchost.exe
Token: SeShutdownPrivilege	2044	svchost.exe
Token: SeCreatePagefilePrivilege	2044	svchost.exe

Suspicious use of FindShellTrayWindow 15 IoCs

Suspicious use of SendNotifyMessage 15 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1896	1912	1_cr.exe	94
PID 1912 wrote to memory of 1896	1912	1_cr.exe	94
PID 1912 wrote to memory of 1896	1912	1_cr.exe	94

C:\Users\Admin\AppData\Local\Temp\1_cr.exe
"C:\Users\Admin\AppData\Local\Temp\1_cr.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -executionpolicy bypass C:\Users\Admin\AppData\Local\Temp\mByZgmXsR.ps1
  2⤵
  PID:1896

memory/2044-142-0x000002083C5C0000-0x000002083C5C4000-memory.dmp

Filesize
16KB

Download