029b7e3eef4e55b781e45c511d40aa6ce0f856fcfacf99b24f2ebd8ef89fed04

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

029b7e3eef4e55b781e45c511d40aa6ce0f856fcfacf99b24f2ebd8ef89fed04.exe
Size

493KB
MD5

0a4a84a82a66dabb72140e108c87b196
SHA1

bbb94a53a895444f26599c1157a5087c4c72a457
SHA256

029b7e3eef4e55b781e45c511d40aa6ce0f856fcfacf99b24f2ebd8ef89fed04
SHA512

af1b07ce189ba70e7bc3e2da70d0e41a9240f53e132d8af1a3da862259a95ee8e553c73dfc59161f76f33f56f85cff009a585c6e31a1417b5e0c7b1208411713
SSDEEP

12288:K1Ra1rN4wopVauKAxZkhwryINtTirdorX:KDrp4XAx+hwrywTEdo

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1336	EntSver.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\EntSver.exe	029b7e3eef4e55b781e45c511d40aa6ce0f856fcfacf99b24f2ebd8ef89fed04.exe
File opened for modification	C:\Windows\EntSver.exe	029b7e3eef4e55b781e45c511d40aa6ce0f856fcfacf99b24f2ebd8ef89fed04.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1780	029b7e3eef4e55b781e45c511d40aa6ce0f856fcfacf99b24f2ebd8ef89fed04.exe
Token: SeDebugPrivilege	1336	EntSver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1336	EntSver.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 692	1336	EntSver.exe	83
PID 1336 wrote to memory of 692	1336	EntSver.exe	83

C:\Users\Admin\AppData\Local\Temp\029b7e3eef4e55b781e45c511d40aa6ce0f856fcfacf99b24f2ebd8ef89fed04.exe
"C:\Users\Admin\AppData\Local\Temp\029b7e3eef4e55b781e45c511d40aa6ce0f856fcfacf99b24f2ebd8ef89fed04.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1780

C:\Windows\EntSver.exe
C:\Windows\EntSver.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\EntSver.exe

Filesize
493KB

MD5
0a4a84a82a66dabb72140e108c87b196

SHA1
bbb94a53a895444f26599c1157a5087c4c72a457

SHA256
029b7e3eef4e55b781e45c511d40aa6ce0f856fcfacf99b24f2ebd8ef89fed04

SHA512
af1b07ce189ba70e7bc3e2da70d0e41a9240f53e132d8af1a3da862259a95ee8e553c73dfc59161f76f33f56f85cff009a585c6e31a1417b5e0c7b1208411713

Download Submit
C:\Windows\EntSver.exe

Filesize
493KB

MD5
0a4a84a82a66dabb72140e108c87b196

SHA1
bbb94a53a895444f26599c1157a5087c4c72a457

SHA256
029b7e3eef4e55b781e45c511d40aa6ce0f856fcfacf99b24f2ebd8ef89fed04

SHA512
af1b07ce189ba70e7bc3e2da70d0e41a9240f53e132d8af1a3da862259a95ee8e553c73dfc59161f76f33f56f85cff009a585c6e31a1417b5e0c7b1208411713

Download Submit
memory/1336-139-0x0000000000D50000-0x0000000000D93000-memory.dmp

Filesize
268KB

Download
memory/1336-137-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/1336-141-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/1336-142-0x0000000000D50000-0x0000000000D93000-memory.dmp

Filesize
268KB

Download
memory/1780-132-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/1780-133-0x00000000021B0000-0x00000000021F3000-memory.dmp

Filesize
268KB

Download
memory/1780-134-0x00000000023A0000-0x00000000023A3000-memory.dmp

Filesize
12KB

Download
memory/1780-138-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/1780-140-0x00000000021B0000-0x00000000021F3000-memory.dmp

Filesize
268KB

Download