7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 09:26

Target

7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe
Size

40KB
MD5

ec7cb550ea81fb37cb32b554447c324a
SHA1

940143ee05501a3081a34456f7e59589d65ba9d4
SHA256

7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042
SHA512

c218f6079e54bc74cb60c3889adf3616d8a8433ffe0944a372f4a304ba4cf9bdb05218412439d894875d338757193c71bc7590d056305c97a4a493c57963f670
SSDEEP

768:r7+kabfs3o2LfEV0mF82DmOVkFP6Gw7fx55QOssBUaDh:2Ng39LfECRSVkFP6HJ55nDh

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1088	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\efcDTNhi.dll	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe
File created	C:\Windows\SysWOW64\efcDTNhi.dll	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 416	1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	3
PID 1104 wrote to memory of 1608	1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	27
PID 1104 wrote to memory of 1608	1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	27
PID 1104 wrote to memory of 1608	1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	27
PID 1104 wrote to memory of 1608	1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	27
PID 1104 wrote to memory of 1608	1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	27
PID 1104 wrote to memory of 1608	1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	27
PID 1104 wrote to memory of 1608	1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	27
PID 1104 wrote to memory of 1088	1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	28
PID 1104 wrote to memory of 1088	1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	28
PID 1104 wrote to memory of 1088	1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	28
PID 1104 wrote to memory of 1088	1104	7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe	28

C:\Users\Admin\AppData\Local\Temp\7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe
"C:\Users\Admin\AppData\Local\Temp\7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe ›twæÝõw,a
  2⤵
  PID:1608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\7bf29fc3e09fa211d3473e5dcc75ccb5af818acd1167bfa6261fb6e1cbace042.exe"
  2⤵
  - Deletes itself
  PID:1088

C:\Users\Admin\AppData\Local\Temp\removalfile.bat

Filesize
43B

MD5
9a7ef09167a6f4433681b94351509043

SHA1
259b1375ed8e84943ca1d42646bb416325c89e12

SHA256
d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7

SHA512
96b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df

Download Submit
\Windows\SysWOW64\efcDTNhi.dll

Filesize
29KB

MD5
92ee37a8048ea4a1f5e55385d7ed257a

SHA1
07ee3f282448b560371ead6f4989ba668168ea2a

SHA256
e715060b64071d2371ccd4b3450555fd0801c32381a8ca463633c2d85883b062

SHA512
d09600ef62433f2189d6e84e6c056c5a88b4c63ce47c410a9ce92daf73947a35ef387b8cb9da99ee86412a1405703abf78b922271adef4163672e5140b7157df

Download Submit
memory/1104-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/1104-58-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1104-57-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/1104-56-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1104-59-0x0000000000230000-0x0000000000234000-memory.dmp

Filesize
16KB

Download