77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 06:28

Target

77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe
Size

128KB
MD5

3308181cb745b218f57616f014285c44
SHA1

e8796386fd259227487d8ce2d80f39db4acb59fa
SHA256

77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd
SHA512

a7d1dae10791ae71b885442e17dac3fd491970c43e039f5bae2f4cdd7589d87e07d862d8b1369836fa4bb046b2d85cbc8d023cf3be9ee8d597cf8afb80c8806c
SSDEEP

1536:e8GasXvoUrE71JtRbRG4WowtDAlsMsy0nCTRuRt/yHB:e8HgGxfarASMsG9ct/yHB

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4944	tyhhyg.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\tyhhyg.exe	77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4120	4944	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4452	77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe
4452	77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe
4452	77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe
4452	77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe
4452	77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe
4452	77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe
4944	tyhhyg.exe
4944	tyhhyg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	4452	77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 4944	4452	77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe	80
PID 4452 wrote to memory of 4944	4452	77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe	80
PID 4452 wrote to memory of 4944	4452	77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe	80
PID 4452 wrote to memory of 3464	4452	77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe	85
PID 4452 wrote to memory of 3464	4452	77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe	85
PID 4452 wrote to memory of 3464	4452	77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe	85

C:\Users\Admin\AppData\Local\Temp\77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe
"C:\Users\Admin\AppData\Local\Temp\77d60a3b547e6d3f3a7f0fbde8772b354b1f4ad2170d91a6f710e2e8d366a0bd.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files\tyhhyg.exe
  "C:\Program Files\tyhhyg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 392
    3⤵
    - Program crash
    PID:4120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c afc9fe2f418b00a0.bat
  2⤵
  PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4944 -ip 4944
1⤵
PID:2964

C:\Program Files\tyhhyg.exe

Filesize
50.1MB

MD5
2000270d7aeeac517a9fa1d6f8834b78

SHA1
8fd7b78090e8a9e46aa1307a8a94ede565964adb

SHA256
b3419323445583abd7457efbd6b48d15ddd0ad3e8103e1b03abbdcda9f9421de

SHA512
709894429963b8725a8c732ee8e31acaf62f26874d05d6a6469771088c428e8185fb08384c40158e1a6fb20994932640fa9408b2d1f0bcf7fb29fc91982f8de7

Download Submit
C:\Program Files\tyhhyg.exe

Filesize
50.1MB

MD5
2000270d7aeeac517a9fa1d6f8834b78

SHA1
8fd7b78090e8a9e46aa1307a8a94ede565964adb

SHA256
b3419323445583abd7457efbd6b48d15ddd0ad3e8103e1b03abbdcda9f9421de

SHA512
709894429963b8725a8c732ee8e31acaf62f26874d05d6a6469771088c428e8185fb08384c40158e1a6fb20994932640fa9408b2d1f0bcf7fb29fc91982f8de7

Download Submit
C:\Users\Admin\AppData\Local\Temp\afc9fe2f418b00a0.bat

Filesize
2KB

MD5
ba6dd8d966b4bd902a9af86a31f80e6b

SHA1
6e1ec295185fbe396d9a59641bf23ca6d8d87ad7

SHA256
caaedee37570ff037c758a021640a95d7c29c3799d5fe306f7681f91d6a60ac9

SHA512
8fde0360fee19792f52358b04c486a0fcf582e5e8cd2191ef56be1284d466ff82aaa30a52e3ad658a69165cf4a1c71293cee521e60baaef1216adf1c5b28eef4

Download Submit