faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 22:22

Target

faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe
Size

1.3MB
MD5

7374806d72b5da2104c65ac32d0459d1
SHA1

87fd7d69c3d55b2e37cc2ac88f4bcb23f641a6a9
SHA256

faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3
SHA512

b633ac38f8ce8b7cd840f2671d0a51e200a611d400df01c3f32d444752e9d6aa72a5d994fdb89ab2f2d146149566742a9736b1923ed5af225ea2299f65629b28
SSDEEP

24576:LYAMeEYhr2HqCKGEGQkwYMiaPeH2jj5zksQF0fR0y1bx4b3DZ:UOS7tE+5TITlgL0fiy74bzZ

Score

6^/10

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe
File created	C:\Windows\assembly\Desktop.ini	faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2088	faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe
2088	faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe
2088	faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe
2088	faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2088	faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe
Token: 33	2088	faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe
Token: SeIncBasePriorityPrivilege	2088	faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 876	2088	faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe	81
PID 2088 wrote to memory of 876	2088	faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe	81
PID 2088 wrote to memory of 876	2088	faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe	81

C:\Users\Admin\AppData\Local\Temp\faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe
"C:\Users\Admin\AppData\Local\Temp\faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe
  C:\Users\Admin\AppData\Local\Temp\faed4a7405b67a9a4a2cd97e3348841ed960bafae6c0c7e191570b1d982630c3.exe
  2⤵
  PID:876

memory/2088-132-0x00000000745F0000-0x0000000074BA1000-memory.dmp

Filesize
5.7MB

Download
memory/2088-133-0x00000000745F0000-0x0000000074BA1000-memory.dmp

Filesize
5.7MB

Download
memory/2088-135-0x00000000745F0000-0x0000000074BA1000-memory.dmp

Filesize
5.7MB

Download