5b1991532948e2f256a1cce92340a6a4f2ef3333d3dd7819a7e45f5a9f0647ff

Analysis

max time kernel
135s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2022, 23:53

Target

5b1991532948e2f256a1cce92340a6a4f2ef3333d3dd7819a7e45f5a9f0647ff.exe
Size

278KB
MD5

155444d8644af17d00223d33d56c88b7
SHA1

377fa97a601b65361fb49a9ab188e6b4f1609d65
SHA256

5b1991532948e2f256a1cce92340a6a4f2ef3333d3dd7819a7e45f5a9f0647ff
SHA512

f26253b1822e55d2b6376b68f9de4c96fbd23f5c2ef7a23701bdcc8ebee13f24fd5a22cc97f0d034e8bfaedbd8f6fccd7b45fce6efc0303816a4c45f19ae4838
SSDEEP

6144:C4h6Sn6jSjASNuCpvZZE8Vd2R8kNorhIAhao98YtTvU56G:jceA/yvZlvENoBh/zI6G

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3120	Hacker.com.cn.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Hacker.com.cn.exe	5b1991532948e2f256a1cce92340a6a4f2ef3333d3dd7819a7e45f5a9f0647ff.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	5b1991532948e2f256a1cce92340a6a4f2ef3333d3dd7819a7e45f5a9f0647ff.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2492	5b1991532948e2f256a1cce92340a6a4f2ef3333d3dd7819a7e45f5a9f0647ff.exe
Token: SeDebugPrivilege	3120	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3120	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 4412	3120	Hacker.com.cn.exe	81
PID 3120 wrote to memory of 4412	3120	Hacker.com.cn.exe	81

C:\Windows\Hacker.com.cn.exe
C:\Windows\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:4412

C:\Windows\Hacker.com.cn.exe

Filesize
278KB

MD5
155444d8644af17d00223d33d56c88b7

SHA1
377fa97a601b65361fb49a9ab188e6b4f1609d65

SHA256
5b1991532948e2f256a1cce92340a6a4f2ef3333d3dd7819a7e45f5a9f0647ff

SHA512
f26253b1822e55d2b6376b68f9de4c96fbd23f5c2ef7a23701bdcc8ebee13f24fd5a22cc97f0d034e8bfaedbd8f6fccd7b45fce6efc0303816a4c45f19ae4838

Download Submit
C:\Windows\Hacker.com.cn.exe

Filesize
278KB

MD5
155444d8644af17d00223d33d56c88b7

SHA1
377fa97a601b65361fb49a9ab188e6b4f1609d65

SHA256
5b1991532948e2f256a1cce92340a6a4f2ef3333d3dd7819a7e45f5a9f0647ff

SHA512
f26253b1822e55d2b6376b68f9de4c96fbd23f5c2ef7a23701bdcc8ebee13f24fd5a22cc97f0d034e8bfaedbd8f6fccd7b45fce6efc0303816a4c45f19ae4838

Download Submit
memory/2492-132-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2492-136-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/3120-135-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/3120-137-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download