6981a3ae3cf398d5a1804d43fbdf38fb1a5dde28d102083f44b430120477283c

Analysis

max time kernel
136s
max time network
150s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 14:40

Target

6981a3ae3cf398d5a1804d43fbdf38fb1a5dde28d102083f44b430120477283c.exe
Size

743KB
MD5

92c947f4f00a6a5d2a25675042926a4d
SHA1

63cb3c5237a7c8db5088fc8e7f9cc798fb5635aa
SHA256

6981a3ae3cf398d5a1804d43fbdf38fb1a5dde28d102083f44b430120477283c
SHA512

6353c214035545a3a925b2a60053b7421da2ca20b43d351e5b8a2da8c3e29088db9e80a0b35ba0008084af2acb2a0e794a4799de79b2bc759c9a1a52d848743b
SSDEEP

12288:kRyTSktU4g/n/t0EW5A0zyYvJwQ5oAlK+GE4vebIk6bQQ52LgRg08y5Hpnrzv:IStU4gf2EW5A2DJr/kS4vGIk6v3Hf

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
956	Hacker.com.cn.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Hacker.com.cn.exe	6981a3ae3cf398d5a1804d43fbdf38fb1a5dde28d102083f44b430120477283c.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	6981a3ae3cf398d5a1804d43fbdf38fb1a5dde28d102083f44b430120477283c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	6981a3ae3cf398d5a1804d43fbdf38fb1a5dde28d102083f44b430120477283c.exe
Token: SeDebugPrivilege	956	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
956	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 912	956	Hacker.com.cn.exe	28
PID 956 wrote to memory of 912	956	Hacker.com.cn.exe	28
PID 956 wrote to memory of 912	956	Hacker.com.cn.exe	28
PID 956 wrote to memory of 912	956	Hacker.com.cn.exe	28

C:\Windows\Hacker.com.cn.exe
C:\Windows\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:956
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:912

C:\Windows\Hacker.com.cn.exe

Filesize
743KB

MD5
92c947f4f00a6a5d2a25675042926a4d

SHA1
63cb3c5237a7c8db5088fc8e7f9cc798fb5635aa

SHA256
6981a3ae3cf398d5a1804d43fbdf38fb1a5dde28d102083f44b430120477283c

SHA512
6353c214035545a3a925b2a60053b7421da2ca20b43d351e5b8a2da8c3e29088db9e80a0b35ba0008084af2acb2a0e794a4799de79b2bc759c9a1a52d848743b

Download Submit
C:\Windows\Hacker.com.cn.exe

Filesize
743KB

MD5
92c947f4f00a6a5d2a25675042926a4d

SHA1
63cb3c5237a7c8db5088fc8e7f9cc798fb5635aa

SHA256
6981a3ae3cf398d5a1804d43fbdf38fb1a5dde28d102083f44b430120477283c

SHA512
6353c214035545a3a925b2a60053b7421da2ca20b43d351e5b8a2da8c3e29088db9e80a0b35ba0008084af2acb2a0e794a4799de79b2bc759c9a1a52d848743b

Download Submit
memory/1720-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download