54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434

Analysis

max time kernel
142s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 08:50

Target

54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
Size

331KB
MD5

706b02fd6e9f81c4057f0807ac50b90a
SHA1

0adacfe714876a5d31dbd97477153053645dd0ac
SHA256

54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434
SHA512

b840a2ceeafdf33f843ff295ed04bba83d59f6ff23db178d7f90cf204d961b5eb3b6b1d71fd0e302e47d48eb71f20bdcbb7c2a1a8eefd432989539dbb0119678
SSDEEP

6144:vFGF2idZecnl20lHRxp3golk9ihl0/srEQpPK+e1FtEuxF+U2/k:vAF3Z4mxxvoEtlK+kt9T2M

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1620	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe

Deletes itself 1 IoCs

pid	Process
1860	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
File opened for modification	C:\Windows\SysWOW64\54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1612	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
1612	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
1612	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1612	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1860	1612	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe	27
PID 1612 wrote to memory of 1860	1612	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe	27
PID 1612 wrote to memory of 1860	1612	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe	27
PID 1612 wrote to memory of 1860	1612	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe	27

C:\Users\Admin\AppData\Local\Temp\54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
"C:\Users\Admin\AppData\Local\Temp\54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\54F96A~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1860

C:\Windows\SysWOW64\54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
C:\Windows\SysWOW64\54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
1⤵
- Executes dropped EXE
PID:1620

C:\Windows\SysWOW64\54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe

Filesize
331KB

MD5
706b02fd6e9f81c4057f0807ac50b90a

SHA1
0adacfe714876a5d31dbd97477153053645dd0ac

SHA256
54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434

SHA512
b840a2ceeafdf33f843ff295ed04bba83d59f6ff23db178d7f90cf204d961b5eb3b6b1d71fd0e302e47d48eb71f20bdcbb7c2a1a8eefd432989539dbb0119678

Download Submit
memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1612-57-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1612-59-0x00000000005D0000-0x0000000000624000-memory.dmp

Filesize
336KB

Download
memory/1620-60-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/1620-61-0x00000000009C0000-0x0000000000A14000-memory.dmp

Filesize
336KB

Download