190b7d597060695b54e62b2e25cc57dbadab2797f8d26726f8ddee73bc83d96a

Analysis

max time kernel
81s
max time network
73s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
08/05/2023, 13:42

Target

hello.exe
Size

40KB
MD5

e8367af1931ea3d32ef90cd1cd2e2ba2
SHA1

a4376d0e20ec37eea2233420320375994adfa6d3
SHA256

190b7d597060695b54e62b2e25cc57dbadab2797f8d26726f8ddee73bc83d96a
SHA512

f4f436e5ab7661395867bf062de6eb225def1ae1c7785037dc3c8914440e1760ecbb6b26482fbee9eecc6bc7f1303699a638416c1288a727ae4126ce80f76a0a
SSDEEP

384:F5OpiEdKOGrQz1I4GS1dphmKyxfY4BcxIYd2PeuaBU3losjuzZ6UwYRGZqK7MuZH:EiEda0TCPYpOPP3lLuzZPKqtuUQIpsd

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	PowerShell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 3432	1256	PowerShell.exe	74
PID 1256 wrote to memory of 3432	1256	PowerShell.exe	74
PID 1256 wrote to memory of 3432	1256	PowerShell.exe	74

C:\Users\Admin\AppData\Local\Temp\hello.exe
"C:\Users\Admin\AppData\Local\Temp\hello.exe"
1⤵
PID:4072

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2596

C:\Users\Admin\AppData\Local\Temp\hello.exe
"C:\Users\Admin\AppData\Local\Temp\hello.exe"
1⤵
PID:4468

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"PowerShell.exe" -noexit -command Set-Location -literalPath 'C:\Users\Admin\AppData\Local\Temp'
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Users\Admin\AppData\Local\Temp\hello.exe
  "C:\Users\Admin\AppData\Local\Temp\hello.exe"
  2⤵
  PID:3432

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_swnhtjju.2x1.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/1256-127-0x0000019A9FFF0000-0x0000019AA0012000-memory.dmp

Filesize
136KB

Download
memory/1256-140-0x0000019A9FFE0000-0x0000019A9FFF0000-memory.dmp

Filesize
64KB

Download
memory/1256-141-0x0000019A9FFE0000-0x0000019A9FFF0000-memory.dmp

Filesize
64KB

Download
memory/1256-156-0x0000019AA0160000-0x0000019AA019C000-memory.dmp

Filesize
240KB

Download
memory/1256-167-0x0000019AA06B0000-0x0000019AA0726000-memory.dmp

Filesize
472KB

Download
memory/1256-177-0x0000019AA01A0000-0x0000019AA01BE000-memory.dmp

Filesize
120KB

Download
memory/3432-183-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4072-119-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4468-120-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download