52b664beaf1ea12a3090e831489ba4f5487ecd2de54e31194c8d920d7f29cf42

Analysis

max time kernel
55s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:12

Target

52b664beaf1ea12a3090e831489ba4f5487ecd2de54e31194c8d920d7f29cf42.exe
Size

93KB
MD5

c12d14e80d88e682ab7a40c430dc3d02
SHA1

0451d994a6cfac8d5f5d93a540df9deb543a149e
SHA256

52b664beaf1ea12a3090e831489ba4f5487ecd2de54e31194c8d920d7f29cf42
SHA512

8145f06d1499b6a53ec07e6e5d19a0090297ee4e3395d34380c41ff69a7366eb740cabaefd663d9020cf9f34cb501b3f3e97ec4fb3c1eb0ea6c8601c539ac34c
SSDEEP

1536:+HxCaqYLXJOfEbvdTvqGORq0H/waHXxoqNFcMeYxoPRQf:+Hx8YL02HamwFDoPy

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

lsass.exe

pid process

3704 lsass.exe

pid	process
3704	lsass.exe

Drops startup file 1 IoCs

Processes:

52b664beaf1ea12a3090e831489ba4f5487ecd2de54e31194c8d920d7f29cf42.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe	52b664beaf1ea12a3090e831489ba4f5487ecd2de54e31194c8d920d7f29cf42.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

lsass.exeexplorer.exe

pid process

3704 lsass.exe
3476 explorer.exe

pid	process
3704	lsass.exe
3476	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

52b664beaf1ea12a3090e831489ba4f5487ecd2de54e31194c8d920d7f29cf42.exelsass.exe

description	pid	process
Token: SeDebugPrivilege	5116	52b664beaf1ea12a3090e831489ba4f5487ecd2de54e31194c8d920d7f29cf42.exe
Token: SeDebugPrivilege	3704	lsass.exe
Token: SeDebugPrivilege	1072

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

52b664beaf1ea12a3090e831489ba4f5487ecd2de54e31194c8d920d7f29cf42.exelsass.exe

description	pid	process	target process
PID 5116 wrote to memory of 3704	5116	52b664beaf1ea12a3090e831489ba4f5487ecd2de54e31194c8d920d7f29cf42.exe	lsass.exe
PID 5116 wrote to memory of 3704	5116	52b664beaf1ea12a3090e831489ba4f5487ecd2de54e31194c8d920d7f29cf42.exe	lsass.exe
PID 5116 wrote to memory of 3704	5116	52b664beaf1ea12a3090e831489ba4f5487ecd2de54e31194c8d920d7f29cf42.exe	lsass.exe
PID 3704 wrote to memory of 3476	3704	lsass.exe	explorer.exe
PID 3704 wrote to memory of 3476	3704	lsass.exe	explorer.exe

C:\Windows\explorer.exe
C:\Windows\explorer.exe
3⤵
- Suspicious behavior: MapViewOfSection
PID:3476

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe

Filesize
93KB

MD5
c12d14e80d88e682ab7a40c430dc3d02

SHA1
0451d994a6cfac8d5f5d93a540df9deb543a149e

SHA256
52b664beaf1ea12a3090e831489ba4f5487ecd2de54e31194c8d920d7f29cf42

SHA512
8145f06d1499b6a53ec07e6e5d19a0090297ee4e3395d34380c41ff69a7366eb740cabaefd663d9020cf9f34cb501b3f3e97ec4fb3c1eb0ea6c8601c539ac34c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe

Filesize
93KB

MD5
c12d14e80d88e682ab7a40c430dc3d02

SHA1
0451d994a6cfac8d5f5d93a540df9deb543a149e

SHA256
52b664beaf1ea12a3090e831489ba4f5487ecd2de54e31194c8d920d7f29cf42

SHA512
8145f06d1499b6a53ec07e6e5d19a0090297ee4e3395d34380c41ff69a7366eb740cabaefd663d9020cf9f34cb501b3f3e97ec4fb3c1eb0ea6c8601c539ac34c

Download Submit
memory/3476-137-0x0000000000000000-mapping.dmp

Download
memory/3476-140-0x0000000001210000-0x0000000001237000-memory.dmp

Filesize
156KB

Download
memory/3704-133-0x0000000000000000-mapping.dmp

Download
memory/3704-139-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3704-138-0x00000000005D0000-0x00000000005F7000-memory.dmp

Filesize
156KB

Download
memory/5116-132-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5116-135-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download