8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99

Analysis

max time kernel
145s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 05:21

Target

8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99.exe
Size

77KB
MD5

524881210eb3b0921c27f84e72481020
SHA1

024f047fa0709b4242c5e35471eb479d310b5484
SHA256

8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99
SHA512

5383bef5b546ff3ae02988e7a42cadd958f7486ea84e79faefcb7c632d501ac0b517518b4d371eb360a1540f7c7985501b7ce710479f1bbbe2f8667bf6a9d164
SSDEEP

1536:dwM7e0mhT/5CmELRaOCuPpY8KluHutu8sx+BkR2I+hd:mX08T/AmELRaOCpula5

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1112	svcbxax.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svcbxax.exe	8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99.exe
File opened for modification	C:\Windows\SysWOW64\svcbxax.exe	8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4368	8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4772	4368	8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99.exe	88
PID 4368 wrote to memory of 4772	4368	8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99.exe	88
PID 4368 wrote to memory of 4772	4368	8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99.exe	88

C:\Users\Admin\AppData\Local\Temp\8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99.exe
"C:\Users\Admin\AppData\Local\Temp\8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\8FE386~1.EXE > nul
  2⤵
  PID:4772

C:\Windows\SysWOW64\svcbxax.exe
C:\Windows\SysWOW64\svcbxax.exe
1⤵
- Executes dropped EXE
PID:1112

C:\Windows\SysWOW64\svcbxax.exe

Filesize
77KB

MD5
524881210eb3b0921c27f84e72481020

SHA1
024f047fa0709b4242c5e35471eb479d310b5484

SHA256
8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99

SHA512
5383bef5b546ff3ae02988e7a42cadd958f7486ea84e79faefcb7c632d501ac0b517518b4d371eb360a1540f7c7985501b7ce710479f1bbbe2f8667bf6a9d164

Download Submit
C:\Windows\SysWOW64\svcbxax.exe

Filesize
77KB

MD5
524881210eb3b0921c27f84e72481020

SHA1
024f047fa0709b4242c5e35471eb479d310b5484

SHA256
8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99

SHA512
5383bef5b546ff3ae02988e7a42cadd958f7486ea84e79faefcb7c632d501ac0b517518b4d371eb360a1540f7c7985501b7ce710479f1bbbe2f8667bf6a9d164

Download Submit