22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 14:38

Target

22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf.exe
Size

242KB
MD5

03cc0662c097f33e251014eba9ca8709
SHA1

9a6494e58c2750847ec6f6e01c21ae83fb0f8216
SHA256

22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf
SHA512

17ebdbc83f45b820cb2dd10949254a23e7eb60c5972837f5975f9c0c3f579dfada836d1e610c20e95774e010aa852695f6c604bfbb7c7c8f67b3cb68033b7b60
SSDEEP

6144:Rkmk/e2bsvPunAdHbzwZlhRoFKPXdUg+pjZpyyw5:Rfk/DwvGsf0hvXP+pjC

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4512	Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Service.exe	22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf.exe
File opened for modification	C:\Windows\Service.exe	22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Service.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf.exe
Token: SeDebugPrivilege	4512	Service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4512	Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4184	4512	Service.exe	88
PID 4512 wrote to memory of 4184	4512	Service.exe	88

C:\Windows\Service.exe
C:\Windows\Service.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:4184

C:\Windows\Service.exe

Filesize
242KB

MD5
03cc0662c097f33e251014eba9ca8709

SHA1
9a6494e58c2750847ec6f6e01c21ae83fb0f8216

SHA256
22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf

SHA512
17ebdbc83f45b820cb2dd10949254a23e7eb60c5972837f5975f9c0c3f579dfada836d1e610c20e95774e010aa852695f6c604bfbb7c7c8f67b3cb68033b7b60

Download Submit
C:\Windows\Service.exe

Filesize
242KB

MD5
03cc0662c097f33e251014eba9ca8709

SHA1
9a6494e58c2750847ec6f6e01c21ae83fb0f8216

SHA256
22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf

SHA512
17ebdbc83f45b820cb2dd10949254a23e7eb60c5972837f5975f9c0c3f579dfada836d1e610c20e95774e010aa852695f6c604bfbb7c7c8f67b3cb68033b7b60

Download Submit
memory/2260-132-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/2260-133-0x00000000007A0000-0x00000000007A4000-memory.dmp

Filesize
16KB

Download
memory/2260-136-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/4512-137-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/4512-138-0x0000000000C80000-0x0000000000C84000-memory.dmp

Filesize
16KB

Download
memory/4512-139-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/4512-140-0x0000000000C80000-0x0000000000C84000-memory.dmp

Filesize
16KB

Download