0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65

Analysis

max time kernel
175s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 14:57

Target

0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe
Size

88KB
MD5

133675926a430d3d6dfd83df8bbd5580
SHA1

285c7f4fe38ab53343666f05b71e156796b4cf28
SHA256

0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65
SHA512

6fb77d3650750f1410dc3d87ae5a644aa559c2014eb4b59f98a77dac435e23183b7491e1f117db8693289d544a5a4dfd34eb0aea6705f99e574273222a86f0cc
SSDEEP

1536:w5t2PfE7TYOHXup+zNZeCfAJiIVqo2S/E9PAdqnCK81v3E0nrRIWdQSZBPdEqkf:w5YfE7TJupyNYApgQ0aCKav3E0n1mSZY

Score

8^/10

upx

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\HideSys.sys	0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe

Executes dropped EXE 1 IoCs

pid	Process
2712	0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x00050000000229b1-133.dat	upx
behavioral2/files/0x00050000000229b1-134.dat	upx
behavioral2/memory/1072-135-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral2/memory/2712-136-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral2/memory/1072-137-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\IAJ\0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe	0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe
File opened for modification	C:\WINDOWS\IAJ\0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe	0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe

Suspicious behavior: LoadsDriver 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2712	1072	0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe	83
PID 1072 wrote to memory of 2712	1072	0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe	83
PID 1072 wrote to memory of 2712	1072	0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe	83
PID 2712 wrote to memory of 2080	2712	0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe	48
PID 2712 wrote to memory of 2080	2712	0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe	48
PID 2712 wrote to memory of 2080	2712	0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe	48
PID 2712 wrote to memory of 2080	2712	0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe	48

C:\WINDOWS\IAJ\0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe

Filesize
88KB

MD5
133675926a430d3d6dfd83df8bbd5580

SHA1
285c7f4fe38ab53343666f05b71e156796b4cf28

SHA256
0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65

SHA512
6fb77d3650750f1410dc3d87ae5a644aa559c2014eb4b59f98a77dac435e23183b7491e1f117db8693289d544a5a4dfd34eb0aea6705f99e574273222a86f0cc

Download Submit
C:\Windows\IAJ\0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65.exe

Filesize
88KB

MD5
133675926a430d3d6dfd83df8bbd5580

SHA1
285c7f4fe38ab53343666f05b71e156796b4cf28

SHA256
0802ab4e34692388aca0d9475ea07ae91697fd6769bcc444aeaffdf6ab10bb65

SHA512
6fb77d3650750f1410dc3d87ae5a644aa559c2014eb4b59f98a77dac435e23183b7491e1f117db8693289d544a5a4dfd34eb0aea6705f99e574273222a86f0cc

Download Submit
memory/1072-135-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1072-137-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2712-136-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download