70ee18fc9f0d5a7db66ba2814d22839e223017726858988b4e4418d535abcb52

Analysis

max time kernel
91s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 06:46

Target

70ee18fc9f0d5a7db66ba2814d22839e223017726858988b4e4418d535abcb52.exe
Size

166KB
MD5

7c5eae216e918e2324366e00b4c1f3be
SHA1

bd07827021543999e180e82e08298aed0300e286
SHA256

70ee18fc9f0d5a7db66ba2814d22839e223017726858988b4e4418d535abcb52
SHA512

5d5410ea7326a38d3528433881f0980dba03ee7b7726153c50664b657de078c4b4245a8d4b6e3b429e5cb50e093864e705bce9a5c94da70e87e90a609884ad8e
SSDEEP

3072:aQbkhaft9yH56ZbfMAuk7HhpYO5u/WLtpHS:lbSa/yHglnpYPWx5

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3460	meciew.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\meciew.exe	70ee18fc9f0d5a7db66ba2814d22839e223017726858988b4e4418d535abcb52.exe
File opened for modification	C:\Windows\SysWOW64\meciew.exe	70ee18fc9f0d5a7db66ba2814d22839e223017726858988b4e4418d535abcb52.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4400	70ee18fc9f0d5a7db66ba2814d22839e223017726858988b4e4418d535abcb52.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 4556	3460	meciew.exe	81
PID 3460 wrote to memory of 4556	3460	meciew.exe	81
PID 3460 wrote to memory of 4556	3460	meciew.exe	81
PID 4400 wrote to memory of 4292	4400	70ee18fc9f0d5a7db66ba2814d22839e223017726858988b4e4418d535abcb52.exe	82
PID 4400 wrote to memory of 4292	4400	70ee18fc9f0d5a7db66ba2814d22839e223017726858988b4e4418d535abcb52.exe	82
PID 4400 wrote to memory of 4292	4400	70ee18fc9f0d5a7db66ba2814d22839e223017726858988b4e4418d535abcb52.exe	82

C:\Users\Admin\AppData\Local\Temp\70ee18fc9f0d5a7db66ba2814d22839e223017726858988b4e4418d535abcb52.exe
"C:\Users\Admin\AppData\Local\Temp\70ee18fc9f0d5a7db66ba2814d22839e223017726858988b4e4418d535abcb52.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\70EE18~1.EXE > nul
  2⤵
  PID:4292

C:\Windows\SysWOW64\meciew.exe

Filesize
166KB

MD5
7c5eae216e918e2324366e00b4c1f3be

SHA1
bd07827021543999e180e82e08298aed0300e286

SHA256
70ee18fc9f0d5a7db66ba2814d22839e223017726858988b4e4418d535abcb52

SHA512
5d5410ea7326a38d3528433881f0980dba03ee7b7726153c50664b657de078c4b4245a8d4b6e3b429e5cb50e093864e705bce9a5c94da70e87e90a609884ad8e

Download Submit
C:\Windows\SysWOW64\meciew.exe

Filesize
166KB

MD5
7c5eae216e918e2324366e00b4c1f3be

SHA1
bd07827021543999e180e82e08298aed0300e286

SHA256
70ee18fc9f0d5a7db66ba2814d22839e223017726858988b4e4418d535abcb52

SHA512
5d5410ea7326a38d3528433881f0980dba03ee7b7726153c50664b657de078c4b4245a8d4b6e3b429e5cb50e093864e705bce9a5c94da70e87e90a609884ad8e

Download Submit