e5fc2d2b594d2ecce4285490bf0b2076e980a69aa06e8a93905a9fd1335322ae

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/02/2023, 07:42

Target

Patch_WinGate_6_2_2_1137_s0cpy.exe
Size

25KB
MD5

912ba3b3d5867a58f3208fe86163104e
SHA1

d3a9dabd2655e179974dfa214d151f912aa1f093
SHA256

e5fc2d2b594d2ecce4285490bf0b2076e980a69aa06e8a93905a9fd1335322ae
SHA512

e334162e97f85814481da3789713c4cb9c4cade7f4eb69aa0d084b4e5df1adf6e17c920f9d9faa6f606a31cc6bb686173a65d69e17dfb5a7ca548d64a680ff5c
SSDEEP

768:5IkG3/TiDHeD6JaYW6cj9c70m3zaRN8Ad1b:5pGPWYqmXm3zaR2Ar

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1700	Patch_WinGate_6_2_2_1137_s0cpy.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1700-56-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1700-59-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1700-64-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\BASSMOD.dll	Patch_WinGate_6_2_2_1137_s0cpy.exe

Runs .reg file with regedit 1 IoCs

pid	Process
892	regedit.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1716	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1716	AUDIODG.EXE
Token: 33	1716	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1716	AUDIODG.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 892	1700	Patch_WinGate_6_2_2_1137_s0cpy.exe	29
PID 1700 wrote to memory of 892	1700	Patch_WinGate_6_2_2_1137_s0cpy.exe	29
PID 1700 wrote to memory of 892	1700	Patch_WinGate_6_2_2_1137_s0cpy.exe	29
PID 1700 wrote to memory of 892	1700	Patch_WinGate_6_2_2_1137_s0cpy.exe	29
PID 1700 wrote to memory of 892	1700	Patch_WinGate_6_2_2_1137_s0cpy.exe	29
PID 1700 wrote to memory of 892	1700	Patch_WinGate_6_2_2_1137_s0cpy.exe	29
PID 1700 wrote to memory of 892	1700	Patch_WinGate_6_2_2_1137_s0cpy.exe	29

C:\Users\Admin\AppData\Local\Temp\Patch_WinGate_6_2_2_1137_s0cpy.exe
"C:\Users\Admin\AppData\Local\Temp\Patch_WinGate_6_2_2_1137_s0cpy.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe -s c:\regpatch.reg
  2⤵
  - Runs .reg file with regedit
  PID:892

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x57c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716

\??\c:\regpatch.reg

Filesize
519B

MD5
26c78412e205a52868401b1d98e38862

SHA1
8e737021c42c66042ff4f47503f90b5932044795

SHA256
99c52f5a26f24b7c2c43aa99c5ae603b53972921b4e6ad78ec94acb142c2bb56

SHA512
b4249b8ec7b1450b9e55a3f5b9ea6e02ccfbfec70a12850364856ed82b0dea2e8be8e868d74f6dbff451f3dbe41c0580b21ee32f4e319122866879ba0bfe6c3a

Download Submit
\Windows\SysWOW64\BASSMOD.dll

Filesize
10KB

MD5
7bac2c6f66524cfc55ae91ddf3ece2dd

SHA1
afd526ca6629c5a6c851d66a2983099a3007935e

SHA256
b10a2f9f733227ec0edb6ed37cb3c8b592b0ae4e4bcedfb650bfc7622ac6aa71

SHA512
4f81516e273d02404e41fd54cac8b5fbe87465dc5554f5665e1b9a4107ba9a9ba34a9222a0061836a558d6db198c0774f98b022992c41750ec2a947dd3bce2bb

Download Submit
memory/1700-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/1700-56-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1700-58-0x0000000000020000-0x000000000003B000-memory.dmp

Filesize
108KB

Download
memory/1700-57-0x0000000000020000-0x000000000003B000-memory.dmp

Filesize
108KB

Download
memory/1700-59-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1700-60-0x0000000000020000-0x000000000003B000-memory.dmp

Filesize
108KB

Download
memory/1700-64-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download