54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434

Analysis

max time kernel
133s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 08:50

Target

54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
Size

331KB
MD5

706b02fd6e9f81c4057f0807ac50b90a
SHA1

0adacfe714876a5d31dbd97477153053645dd0ac
SHA256

54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434
SHA512

b840a2ceeafdf33f843ff295ed04bba83d59f6ff23db178d7f90cf204d961b5eb3b6b1d71fd0e302e47d48eb71f20bdcbb7c2a1a8eefd432989539dbb0119678
SSDEEP

6144:vFGF2idZecnl20lHRxp3golk9ihl0/srEQpPK+e1FtEuxF+U2/k:vAF3Z4mxxvoEtlK+kt9T2M

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2500	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
File opened for modification	C:\Windows\SysWOW64\54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4872	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
4872	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
4872	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
4872	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
4872	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
4872	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4872	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4596	4872	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe	84
PID 4872 wrote to memory of 4596	4872	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe	84
PID 4872 wrote to memory of 4596	4872	54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe	84

C:\Users\Admin\AppData\Local\Temp\54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
"C:\Users\Admin\AppData\Local\Temp\54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\54F96A~1.EXE > nul
  2⤵
  PID:4596

C:\Windows\SysWOW64\54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
C:\Windows\SysWOW64\54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe
1⤵
- Executes dropped EXE
PID:2500

C:\Windows\SysWOW64\54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe

Filesize
331KB

MD5
706b02fd6e9f81c4057f0807ac50b90a

SHA1
0adacfe714876a5d31dbd97477153053645dd0ac

SHA256
54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434

SHA512
b840a2ceeafdf33f843ff295ed04bba83d59f6ff23db178d7f90cf204d961b5eb3b6b1d71fd0e302e47d48eb71f20bdcbb7c2a1a8eefd432989539dbb0119678

Download Submit
C:\Windows\SysWOW64\54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434.exe

Filesize
331KB

MD5
706b02fd6e9f81c4057f0807ac50b90a

SHA1
0adacfe714876a5d31dbd97477153053645dd0ac

SHA256
54f96ad487b60890b7fa0c30eebd1f7a0e6656ab4ea8df0df85ed646e2193434

SHA512
b840a2ceeafdf33f843ff295ed04bba83d59f6ff23db178d7f90cf204d961b5eb3b6b1d71fd0e302e47d48eb71f20bdcbb7c2a1a8eefd432989539dbb0119678

Download Submit
memory/2500-136-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/2500-137-0x0000000000E60000-0x0000000000EB4000-memory.dmp

Filesize
336KB

Download
memory/2500-138-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/4596-134-0x0000000000000000-mapping.dmp

Download
memory/4872-135-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download