05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 03:50

Target

05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe
Size

7KB
MD5

d9bfd1caca84f02354f09c2ad79bedbb
SHA1

03d7b1d70bb1082a458f1ffef79352aa5d3df91f
SHA256

05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811
SHA512

b248958d1cc54f9072d15d7c22b14444f13002182d09ad54906c3d55ee3bf9b104d3401a89872994fe845e2a0fc8a0c97ea9887b6396134644638e6ecaabaa84
SSDEEP

192:5SnF94LYGs/Gr5L/r/iGuUJbAIMwyS5krn:5SHssW5L/GGuUJbAsmrn

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
4128	smss.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1680-132-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0008000000022ddb-134.dat	upx
behavioral2/files/0x0008000000022ddb-135.dat	upx
behavioral2/memory/4128-136-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/1680-138-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/4128-139-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\system\smss.exe	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe
File opened for modification	C:\WINDOWS\system\smss.exe	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe
File opened for modification	C:\WINDOWS\system\windows.log	smss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1680	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 4128	1680	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe	83
PID 1680 wrote to memory of 4128	1680	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe	83
PID 1680 wrote to memory of 4128	1680	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe	83
PID 1680 wrote to memory of 1272	1680	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe	90
PID 1680 wrote to memory of 1272	1680	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe	90
PID 1680 wrote to memory of 1272	1680	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe	90

C:\Users\Admin\AppData\Local\Temp\05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe
"C:\Users\Admin\AppData\Local\Temp\05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\WINDOWS\system\smss.exe
  C:\WINDOWS\system\smss.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:4128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\05D054~1.EXE > nul
  2⤵
  PID:1272

C:\WINDOWS\system\smss.exe

Filesize
7KB

MD5
d9bfd1caca84f02354f09c2ad79bedbb

SHA1
03d7b1d70bb1082a458f1ffef79352aa5d3df91f

SHA256
05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811

SHA512
b248958d1cc54f9072d15d7c22b14444f13002182d09ad54906c3d55ee3bf9b104d3401a89872994fe845e2a0fc8a0c97ea9887b6396134644638e6ecaabaa84

Download Submit
C:\Windows\System\smss.exe

Filesize
7KB

MD5
d9bfd1caca84f02354f09c2ad79bedbb

SHA1
03d7b1d70bb1082a458f1ffef79352aa5d3df91f

SHA256
05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811

SHA512
b248958d1cc54f9072d15d7c22b14444f13002182d09ad54906c3d55ee3bf9b104d3401a89872994fe845e2a0fc8a0c97ea9887b6396134644638e6ecaabaa84

Download Submit
memory/1680-132-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1680-138-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4128-136-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4128-139-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download