cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f

Analysis

max time kernel
112s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 14:12

Target

cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe
Size

50KB
MD5

640e035e648011f5c3b0cd5c808a402a
SHA1

35d0160865ef1fa2c656b8dc7e50bc853f85c3c0
SHA256

cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f
SHA512

69913e1a8e73de128c8e893f645b7216780757304657cde63a20416963b70dc48c0919a36f57df96513cbca0e4cef5e01524a03e2348380bdb67bbf2e14c1cec
SSDEEP

768:4PKrU5MxWV6GCmFvL6u8Udz90q9mpr5UTAJdfR7AoQaUMck83jN9ypn:8K5Vi9mJUNkpr5UAJfWajck83jNEpn

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1768	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\urqqqpn.dll	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe
File created	C:\Windows\SysWOW64\urqqqpn.dll	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1768	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe
1768	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1768	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 604	1768	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	4
PID 1768 wrote to memory of 4416	1768	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	87
PID 1768 wrote to memory of 4416	1768	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	87
PID 1768 wrote to memory of 4416	1768	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	87
PID 1768 wrote to memory of 3080	1768	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	88
PID 1768 wrote to memory of 3080	1768	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	88
PID 1768 wrote to memory of 3080	1768	cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe	88

C:\Users\Admin\AppData\Local\Temp\cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe
"C:\Users\Admin\AppData\Local\Temp\cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe ,Activate
  2⤵
  PID:4416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\cf2da9cc49ed3453375eb054ad5283ec016218b281ede04e1e1a2400ecfbcb8f.exe"
  2⤵
  PID:3080

C:\Users\Admin\AppData\Local\Temp\removalfile.bat

Filesize
43B

MD5
9a7ef09167a6f4433681b94351509043

SHA1
259b1375ed8e84943ca1d42646bb416325c89e12

SHA256
d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7

SHA512
96b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df

Download Submit
C:\Windows\SysWOW64\urqqqpn.dll

Filesize
40KB

MD5
ee093325b1e04a3828a759fb4183b2bb

SHA1
9b0bc6674bbfe6943d265921a84a11dccd9114a5

SHA256
9a021120e7111053fe4d8400440c174cf1ff9fb9115659193cd38109fddfd4ab

SHA512
44b8b28cb930aa9f3c83666ddf81303a925ee672b35eca3131d542fc8d52e4112ec146d211e44c05abf1778e4211c02640d15415891d3010b24fd6a450a4c22f

Download Submit
memory/1768-132-0x0000000000400000-0x0000000000405600-memory.dmp

Filesize
21KB

Download
memory/1768-134-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1768-137-0x0000000000400000-0x0000000000405600-memory.dmp

Filesize
21KB

Download