1faa29d93e78faf53e5c2116a38ae4ccbef5b3bf19ec7218ef0661c09a84606b

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 16:34

Target

1faa29d93e78faf53e5c2116a38ae4ccbef5b3bf19ec7218ef0661c09a84606b.exe
Size

287KB
MD5

6a2e1a13df1b55f218fb38d77521baf2
SHA1

9cf209e7bef6dcb71cd6912ea0846a7aad3a77cc
SHA256

1faa29d93e78faf53e5c2116a38ae4ccbef5b3bf19ec7218ef0661c09a84606b
SHA512

48014488a8dbcd3404d75d8b6460e16b5215f7d4f867b87084cf24f41d14a1e5d42c376f2ddb1fe6b3d25be7d751280c57070932447bea9f35940cfe861628a8
SSDEEP

6144:zgVmfgie8wjcmdbZ1MTKq72DDC3C5b/ew3ur1y+a:z5gP8wjzRsvPmWnr1y1

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

syhe.exe

pid process

1512 syhe.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

syhe.exe

pid process

1512 syhe.exe
1512 syhe.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

syhe.exe

pid process

1512 syhe.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1faa29d93e78faf53e5c2116a38ae4ccbef5b3bf19ec7218ef0661c09a84606b.exe

description pid process

Token: SeSecurityPrivilege 4752 1faa29d93e78faf53e5c2116a38ae4ccbef5b3bf19ec7218ef0661c09a84606b.exe

pid	process
1512	syhe.exe

pid	process
1512	syhe.exe
1512	syhe.exe

pid	process
1512	syhe.exe

description	pid	process
Token: SeSecurityPrivilege	4752	1faa29d93e78faf53e5c2116a38ae4ccbef5b3bf19ec7218ef0661c09a84606b.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1faa29d93e78faf53e5c2116a38ae4ccbef5b3bf19ec7218ef0661c09a84606b.exesyhe.exe

description	pid	process	target process
PID 4752 wrote to memory of 1512	4752	1faa29d93e78faf53e5c2116a38ae4ccbef5b3bf19ec7218ef0661c09a84606b.exe	syhe.exe
PID 4752 wrote to memory of 1512	4752	1faa29d93e78faf53e5c2116a38ae4ccbef5b3bf19ec7218ef0661c09a84606b.exe	syhe.exe
PID 4752 wrote to memory of 1512	4752	1faa29d93e78faf53e5c2116a38ae4ccbef5b3bf19ec7218ef0661c09a84606b.exe	syhe.exe
PID 1512 wrote to memory of 4984	1512	syhe.exe	explorer.exe
PID 1512 wrote to memory of 4984	1512	syhe.exe	explorer.exe
PID 1512 wrote to memory of 4984	1512	syhe.exe	explorer.exe

C:\Users\Admin\AppData\Roaming\Aftu\syhe.exe
Filesize
287KB

MD5
d093ca15bd2f5d9e3b6cc0f0cfda9466

SHA1
8d0d343b206b7addc37687d79844658570e9a86c

SHA256
70ed6ca9a01519ab43a21f69b95e273871a4a156c70407f8222351ec2b25c804

SHA512
ff7ab2e89e70253989fa185fa81cf959c07ec04dd6efd0bb2727fe0396dd891ea68d460fc747b204b90011b02c1b0ecd912146d0cd10594d335b9dc668384c11

Download Submit
C:\Users\Admin\AppData\Roaming\Aftu\syhe.exe
Filesize
287KB

MD5
d093ca15bd2f5d9e3b6cc0f0cfda9466

SHA1
8d0d343b206b7addc37687d79844658570e9a86c

SHA256
70ed6ca9a01519ab43a21f69b95e273871a4a156c70407f8222351ec2b25c804

SHA512
ff7ab2e89e70253989fa185fa81cf959c07ec04dd6efd0bb2727fe0396dd891ea68d460fc747b204b90011b02c1b0ecd912146d0cd10594d335b9dc668384c11

Download Submit
memory/1512-135-0x0000000000000000-mapping.dmp

Download
memory/1512-138-0x0000000002310000-0x0000000002403000-memory.dmp

Filesize
972KB

Download
memory/1512-139-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4752-132-0x00000000024B0000-0x00000000025A3000-memory.dmp

Filesize
972KB

Download
memory/4752-133-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4984-141-0x0000000000000000-mapping.dmp

Download
memory/4984-142-0x0000000000D80000-0x0000000000DAD000-memory.dmp

Filesize
180KB

Download