5f29fd9ee6f0e3cfc7b58babf0603aec4b80ff798e51d5d18e5051bcf7aa1415

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 13:23

Target

5f29fd9ee6f0e3cfc7b58babf0603aec4b80ff798e51d5d18e5051bcf7aa1415.exe
Size

201KB
MD5

6c5d915ca14706b2a638a74d00462cd0
SHA1

3f093a77ef7d7a063772615a099869350d97f962
SHA256

5f29fd9ee6f0e3cfc7b58babf0603aec4b80ff798e51d5d18e5051bcf7aa1415
SHA512

6fee73c749648764cfc1756d416a61bd887912b967fc0babeaa9f8aad832154a643a12640ce4af0d12251cc8d11c3cbe1e986d4968ec422d82d7463d9322182e
SSDEEP

6144:Cif8zIuCVYlxqfYTniz7KrHSF62oRludqw:B8zBQiqfYzg7KLq6KdL

Score

7^/10

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5040	5f29fd9ee6f0e3cfc7b58babf0603aec4b80ff798e51d5d18e5051bcf7aa1415.exe
5040	5f29fd9ee6f0e3cfc7b58babf0603aec4b80ff798e51d5d18e5051bcf7aa1415.exe
5040	5f29fd9ee6f0e3cfc7b58babf0603aec4b80ff798e51d5d18e5051bcf7aa1415.exe
5040	5f29fd9ee6f0e3cfc7b58babf0603aec4b80ff798e51d5d18e5051bcf7aa1415.exe
5040	5f29fd9ee6f0e3cfc7b58babf0603aec4b80ff798e51d5d18e5051bcf7aa1415.exe
5040	5f29fd9ee6f0e3cfc7b58babf0603aec4b80ff798e51d5d18e5051bcf7aa1415.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
380	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	5f29fd9ee6f0e3cfc7b58babf0603aec4b80ff798e51d5d18e5051bcf7aa1415.exe
Token: SeDebugPrivilege	5040	5f29fd9ee6f0e3cfc7b58babf0603aec4b80ff798e51d5d18e5051bcf7aa1415.exe
Token: SeDebugPrivilege	5040	5f29fd9ee6f0e3cfc7b58babf0603aec4b80ff798e51d5d18e5051bcf7aa1415.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 380	5040	5f29fd9ee6f0e3cfc7b58babf0603aec4b80ff798e51d5d18e5051bcf7aa1415.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:380
- C:\Users\Admin\AppData\Local\Temp\5f29fd9ee6f0e3cfc7b58babf0603aec4b80ff798e51d5d18e5051bcf7aa1415.exe
  "C:\Users\Admin\AppData\Local\Temp\5f29fd9ee6f0e3cfc7b58babf0603aec4b80ff798e51d5d18e5051bcf7aa1415.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5040

memory/5040-132-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5040-133-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5040-134-0x00000000024F0000-0x0000000002527000-memory.dmp

Filesize
220KB

Download