28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6

Analysis

max time kernel
146s
max time network
160s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 17:13

Target

28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe
Size

19KB
MD5

01546f8b92074757fcdfddc41889286a
SHA1

b5bd6c3687f431dec629569ac128258d6760eb06
SHA256

28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6
SHA512

92ad66deb46966c53e7dc3dd4334a99f5053c92159d88d171d716b9a233d05b3cda9b031364a179a257de8073423e375f2b0bf79ea522787455d46573aa4c726
SSDEEP

384:WN2vDagPQ3IsKXe3b+SCZ6Ta5/GYKiboA7VEhHEHbl57qKNSsD3d66Efo6:i2+gPQ3LAMb+SCZ6u9PxQHE7l57qKNSr

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
844	28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe

Deletes itself 1 IoCs

pid	Process
952	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe	28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe
File opened for modification	C:\Windows\28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe	28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	368	28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 952	368	28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe	28
PID 368 wrote to memory of 952	368	28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe	28
PID 368 wrote to memory of 952	368	28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe	28
PID 368 wrote to memory of 952	368	28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe	28

C:\Users\Admin\AppData\Local\Temp\28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe
"C:\Users\Admin\AppData\Local\Temp\28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\28FCEF~1.EXE > nul
  2⤵
  - Deletes itself
  PID:952

C:\Windows\28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe
C:\Windows\28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe
1⤵
- Executes dropped EXE
PID:844

C:\Windows\28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe

Filesize
19KB

MD5
01546f8b92074757fcdfddc41889286a

SHA1
b5bd6c3687f431dec629569ac128258d6760eb06

SHA256
28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6

SHA512
92ad66deb46966c53e7dc3dd4334a99f5053c92159d88d171d716b9a233d05b3cda9b031364a179a257de8073423e375f2b0bf79ea522787455d46573aa4c726

Download Submit
memory/368-54-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/368-55-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/368-60-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/844-58-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/844-61-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/952-59-0x0000000000000000-mapping.dmp

Download