bf28532d599364f6543eb5136658b48633fe14d27a0e3e3797daacc99ceebaee

Analysis

max time kernel
153s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 19:37

Target

bf28532d599364f6543eb5136658b48633fe14d27a0e3e3797daacc99ceebaee.exe
Size

131KB
MD5

6ca1defae3abad0ada518ce2469a4680
SHA1

97e05b04147d3dbef82cb29cb873dc2a47e04f62
SHA256

bf28532d599364f6543eb5136658b48633fe14d27a0e3e3797daacc99ceebaee
SHA512

d15ef25c71c6dea6db8e0fe28e5191e7d0829257891a62adbe5d5e459e340aece38361dd153ae061170c5f14c1997a8dea2830cbf8884f21435c14c939d9bfb9
SSDEEP

3072:qqPmtYmvwUtTBfCqQNpy/EJqPmtYmvwUtTBfCqQNpy/EG:teiqwUtTBaqXneiqwUtTBaqXH

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2820	gvwlsq.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gvwlsq.exe	bf28532d599364f6543eb5136658b48633fe14d27a0e3e3797daacc99ceebaee.exe
File opened for modification	C:\Windows\SysWOW64\gvwlsq.exe	bf28532d599364f6543eb5136658b48633fe14d27a0e3e3797daacc99ceebaee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4068	bf28532d599364f6543eb5136658b48633fe14d27a0e3e3797daacc99ceebaee.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 1340	4068	bf28532d599364f6543eb5136658b48633fe14d27a0e3e3797daacc99ceebaee.exe	83
PID 4068 wrote to memory of 1340	4068	bf28532d599364f6543eb5136658b48633fe14d27a0e3e3797daacc99ceebaee.exe	83
PID 4068 wrote to memory of 1340	4068	bf28532d599364f6543eb5136658b48633fe14d27a0e3e3797daacc99ceebaee.exe	83

C:\Users\Admin\AppData\Local\Temp\bf28532d599364f6543eb5136658b48633fe14d27a0e3e3797daacc99ceebaee.exe
"C:\Users\Admin\AppData\Local\Temp\bf28532d599364f6543eb5136658b48633fe14d27a0e3e3797daacc99ceebaee.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\BF2853~1.EXE > nul
  2⤵
  PID:1340

C:\Windows\SysWOW64\gvwlsq.exe
C:\Windows\SysWOW64\gvwlsq.exe
1⤵
- Executes dropped EXE
PID:2820

C:\Windows\SysWOW64\gvwlsq.exe

Filesize
131KB

MD5
6ca1defae3abad0ada518ce2469a4680

SHA1
97e05b04147d3dbef82cb29cb873dc2a47e04f62

SHA256
bf28532d599364f6543eb5136658b48633fe14d27a0e3e3797daacc99ceebaee

SHA512
d15ef25c71c6dea6db8e0fe28e5191e7d0829257891a62adbe5d5e459e340aece38361dd153ae061170c5f14c1997a8dea2830cbf8884f21435c14c939d9bfb9

Download Submit
C:\Windows\SysWOW64\gvwlsq.exe

Filesize
131KB

MD5
6ca1defae3abad0ada518ce2469a4680

SHA1
97e05b04147d3dbef82cb29cb873dc2a47e04f62

SHA256
bf28532d599364f6543eb5136658b48633fe14d27a0e3e3797daacc99ceebaee

SHA512
d15ef25c71c6dea6db8e0fe28e5191e7d0829257891a62adbe5d5e459e340aece38361dd153ae061170c5f14c1997a8dea2830cbf8884f21435c14c939d9bfb9

Download Submit