2ff7e7cf60a0e2323716426af4d591b612b0ff6ff7cf7627738c817afeb2b560

Analysis

max time kernel
151s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 16:45

Target

2ff7e7cf60a0e2323716426af4d591b612b0ff6ff7cf7627738c817afeb2b560.exe
Size

64KB
MD5

0f8744dec783bd5f5a20a21ea79599df
SHA1

e60ccb0410e893e4c0a5f78afd31685f17a392ff
SHA256

2ff7e7cf60a0e2323716426af4d591b612b0ff6ff7cf7627738c817afeb2b560
SHA512

c7b8fe0bc46b90f7f49830796231e0b5818d970e5dde29336894f5f29cc9651f46d679ea206465301194730c9f66826931a49f8024bc1e7b82fec66e3a2bd952
SSDEEP

1536:j7Kcy+tTJE/M8pMVLJ6LX0dui9lOuv8Yp2FSg:fKuTJELpMMX0dpXOukYp2

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\zpefvcsj3.sys	2ff7e7cf60a0e2323716426af4d591b612b0ff6ff7cf7627738c817afeb2b560.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1504	2ff7e7cf60a0e2323716426af4d591b612b0ff6ff7cf7627738c817afeb2b560.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	2ff7e7cf60a0e2323716426af4d591b612b0ff6ff7cf7627738c817afeb2b560.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1536	1504	2ff7e7cf60a0e2323716426af4d591b612b0ff6ff7cf7627738c817afeb2b560.exe	26
PID 1504 wrote to memory of 1536	1504	2ff7e7cf60a0e2323716426af4d591b612b0ff6ff7cf7627738c817afeb2b560.exe	26
PID 1504 wrote to memory of 1536	1504	2ff7e7cf60a0e2323716426af4d591b612b0ff6ff7cf7627738c817afeb2b560.exe	26
PID 1504 wrote to memory of 1536	1504	2ff7e7cf60a0e2323716426af4d591b612b0ff6ff7cf7627738c817afeb2b560.exe	26

C:\Users\Admin\AppData\Local\Temp\2ff7e7cf60a0e2323716426af4d591b612b0ff6ff7cf7627738c817afeb2b560.exe
"C:\Users\Admin\AppData\Local\Temp\2ff7e7cf60a0e2323716426af4d591b612b0ff6ff7cf7627738c817afeb2b560.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\mcbnsjgb.bat
  2⤵
  PID:1536

C:\Users\Admin\AppData\Local\Temp\mcbnsjgb.bat

Filesize
292B

MD5
3e694adda8b79f00a95246c098ad6f46

SHA1
e3da28ba6d2ea56530e813ff2d5d82a88dcea352

SHA256
6e59fe9741d350c3a1237572cd30af1940947aeb8f148cb93f50ed4a67d97ab4

SHA512
5bbb05bfbeefa70361cde5e8b2cc7ab2c6f85533bca91ec4acf829d765f3d079b716cc7e4dcef60b2a5e9e9fa07ad9d5c99fd3ef539af7819f3d169cbb01ec2c

Download Submit
memory/1504-56-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download