28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6

Analysis

max time kernel
153s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 17:13

Target

28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe
Size

19KB
MD5

01546f8b92074757fcdfddc41889286a
SHA1

b5bd6c3687f431dec629569ac128258d6760eb06
SHA256

28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6
SHA512

92ad66deb46966c53e7dc3dd4334a99f5053c92159d88d171d716b9a233d05b3cda9b031364a179a257de8073423e375f2b0bf79ea522787455d46573aa4c726
SSDEEP

384:WN2vDagPQ3IsKXe3b+SCZ6Ta5/GYKiboA7VEhHEHbl57qKNSsD3d66Efo6:i2+gPQ3LAMb+SCZ6u9PxQHE7l57qKNSr

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2188	28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe	28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe
File created	C:\Windows\28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe	28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1664	28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 4776	1664	28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe	80
PID 1664 wrote to memory of 4776	1664	28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe	80
PID 1664 wrote to memory of 4776	1664	28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe	80

C:\Users\Admin\AppData\Local\Temp\28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe
"C:\Users\Admin\AppData\Local\Temp\28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\28FCEF~1.EXE > nul
  2⤵
  PID:4776

C:\Windows\28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe
C:\Windows\28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe
1⤵
- Executes dropped EXE
PID:2188

C:\Windows\28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe

Filesize
19KB

MD5
01546f8b92074757fcdfddc41889286a

SHA1
b5bd6c3687f431dec629569ac128258d6760eb06

SHA256
28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6

SHA512
92ad66deb46966c53e7dc3dd4334a99f5053c92159d88d171d716b9a233d05b3cda9b031364a179a257de8073423e375f2b0bf79ea522787455d46573aa4c726

Download Submit
C:\Windows\28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6.exe

Filesize
19KB

MD5
01546f8b92074757fcdfddc41889286a

SHA1
b5bd6c3687f431dec629569ac128258d6760eb06

SHA256
28fcef13ba50cc4bbac31e2bd81675bffcb5773031a6edc3ebe89e38c0e4fec6

SHA512
92ad66deb46966c53e7dc3dd4334a99f5053c92159d88d171d716b9a233d05b3cda9b031364a179a257de8073423e375f2b0bf79ea522787455d46573aa4c726

Download Submit
memory/1664-132-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1664-137-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2188-135-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2188-138-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download