75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97

Analysis

max time kernel
134s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 00:54

Target

75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe
Size

15KB
MD5

90ec6ddc5c841d1293face3c719035c0
SHA1

b8b550bb0076821d30ce75a721a5f998330581ab
SHA256

75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97
SHA512

bdaf4cad91607cc9d49d24a39051d560f32e1bc9bfbfd5eec41661b1f501cb6bf9432fa088295ee8dba7c33a9c888509ecaeee6fc8049b20e74a287b46797c56
SSDEEP

384:Po4baoJs+xoq6BIy+FrGDgtSyqyHn8SR:Quf6yyzgbH8W

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1328	75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe	75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe
File created	C:\Windows\SysWOW64\75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe	75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4300	75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 432	4300	75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe	81
PID 4300 wrote to memory of 432	4300	75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe	81
PID 4300 wrote to memory of 432	4300	75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe	81

C:\Users\Admin\AppData\Local\Temp\75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe
"C:\Users\Admin\AppData\Local\Temp\75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\75221F~1.EXE > nul
  2⤵
  PID:432

C:\Windows\SysWOW64\75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe
C:\Windows\SysWOW64\75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe
1⤵
- Executes dropped EXE
PID:1328

C:\Windows\SysWOW64\75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe

Filesize
15KB

MD5
90ec6ddc5c841d1293face3c719035c0

SHA1
b8b550bb0076821d30ce75a721a5f998330581ab

SHA256
75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97

SHA512
bdaf4cad91607cc9d49d24a39051d560f32e1bc9bfbfd5eec41661b1f501cb6bf9432fa088295ee8dba7c33a9c888509ecaeee6fc8049b20e74a287b46797c56

Download Submit
C:\Windows\SysWOW64\75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97.exe

Filesize
15KB

MD5
90ec6ddc5c841d1293face3c719035c0

SHA1
b8b550bb0076821d30ce75a721a5f998330581ab

SHA256
75221fb24eff1703a1074ca87b5192f6ad8c3e7f458e7a08ed884254e54d3d97

SHA512
bdaf4cad91607cc9d49d24a39051d560f32e1bc9bfbfd5eec41661b1f501cb6bf9432fa088295ee8dba7c33a9c888509ecaeee6fc8049b20e74a287b46797c56

Download Submit