ccab9ebe29ea04e9013f782b95d8d3643a92af65bdd2ff97f1abbf5f9d7b5dfa

Analysis

max time kernel
291s
max time network
405s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 17:00

Target

ccab9ebe29ea04e9013f782b95d8d3643a92af65bdd2ff97f1abbf5f9d7b5dfa.exe
Size

30KB
MD5

647fe7af0e72334745923201a3e4ab7b
SHA1

76869647b09e065b8732ab9292513cc8291c6d3b
SHA256

ccab9ebe29ea04e9013f782b95d8d3643a92af65bdd2ff97f1abbf5f9d7b5dfa
SHA512

5a73b512aed35f2e9e4c4b245127568c3c591ce62ef99d8e2b8e2465c590bd37c1139eabac27263161c230453007e34d4dd167a4a78355cacd49c2394ef5f843
SSDEEP

768:+iUWH84kkY25pzqEJO+aQpl3HJJQZ2f+GBcOT90ng2lTMyY:vUWH8Hq9JYsVQU/OSan/qz

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\imm32.bmp	ccab9ebe29ea04e9013f782b95d8d3643a92af65bdd2ff97f1abbf5f9d7b5dfa.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3368	ccab9ebe29ea04e9013f782b95d8d3643a92af65bdd2ff97f1abbf5f9d7b5dfa.exe
3368	ccab9ebe29ea04e9013f782b95d8d3643a92af65bdd2ff97f1abbf5f9d7b5dfa.exe
3368	ccab9ebe29ea04e9013f782b95d8d3643a92af65bdd2ff97f1abbf5f9d7b5dfa.exe
3368	ccab9ebe29ea04e9013f782b95d8d3643a92af65bdd2ff97f1abbf5f9d7b5dfa.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	ccab9ebe29ea04e9013f782b95d8d3643a92af65bdd2ff97f1abbf5f9d7b5dfa.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4880	3368	ccab9ebe29ea04e9013f782b95d8d3643a92af65bdd2ff97f1abbf5f9d7b5dfa.exe	80
PID 3368 wrote to memory of 4880	3368	ccab9ebe29ea04e9013f782b95d8d3643a92af65bdd2ff97f1abbf5f9d7b5dfa.exe	80
PID 3368 wrote to memory of 4880	3368	ccab9ebe29ea04e9013f782b95d8d3643a92af65bdd2ff97f1abbf5f9d7b5dfa.exe	80

C:\Users\Admin\AppData\Local\Temp\ccab9ebe29ea04e9013f782b95d8d3643a92af65bdd2ff97f1abbf5f9d7b5dfa.exe
"C:\Users\Admin\AppData\Local\Temp\ccab9ebe29ea04e9013f782b95d8d3643a92af65bdd2ff97f1abbf5f9d7b5dfa.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\ccab9ebe29ea04e9013f782b95d8d3643a92af65bdd2ff97f1abbf5f9d7b5dfa.exe"
  2⤵
  PID:4880