e160b6348f6fbdc444125bb65dbd94606d99da48c8334c8e6b2ee4429f813293

Resubmissions

07-02-2023 20:22

07-02-2023 20:08

max time kernel
629s
max time network
489s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2023 20:08

Target

encF.exe
Size

7.0MB
MD5

8f2b7a45a93ee6f4806918aaa99c1b1b
SHA1

3a71e11a742a1ba1b7c088ce1377bd9eeb0f63f0
SHA256

e160b6348f6fbdc444125bb65dbd94606d99da48c8334c8e6b2ee4429f813293
SHA512

d436d66d97e689b9a05d8b4af1b75fc79ae8ba9880b6f3b9b731c5228f11ad77f621b6b802e29c9aec071f7a486989ea1c45349957b73d52ec1c0ddd6f7312d1
SSDEEP

98304:bAQQU9TWEdwOY7jhM28X5dq8Lk1BssJJmk3om1hV:bAQQU4Mw37jhUX5KAsJJmcoYL

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 4652	2508	cmd.exe	101
PID 2508 wrote to memory of 4652	2508	cmd.exe	101
PID 4652 wrote to memory of 2024	4652	powershell.exe	121
PID 4652 wrote to memory of 2024	4652	powershell.exe	121
PID 4652 wrote to memory of 2024	4652	powershell.exe	121

C:\Users\Admin\AppData\Local\Temp\encF.exe
"C:\Users\Admin\AppData\Local\Temp\encF.exe"
1⤵
PID:4660

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Users\Admin\AppData\Local\Temp\encF.exe
    "C:\Users\Admin\AppData\Local\Temp\encF.exe"
    3⤵
    PID:2024

memory/4652-133-0x000001386F050000-0x000001386F072000-memory.dmp

Filesize
136KB

Download
memory/4652-134-0x000001386F560000-0x000001386F5A4000-memory.dmp

Filesize
272KB

Download
memory/4652-135-0x00007FF808030000-0x00007FF808AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4652-136-0x000001386F630000-0x000001386F6A6000-memory.dmp

Filesize
472KB

Download
memory/4652-137-0x00007FF808030000-0x00007FF808AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4652-138-0x000001386F510000-0x000001386F52E000-memory.dmp

Filesize
120KB

Download