e4e84e4c05fcabc3248a398ff3b4d14794f0c7591e192b3bfdb4ab3c9c1cd9ab

Analysis

max time kernel
62s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2023 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aurora/aurora.exe
Size

10.0MB
MD5

83fbded097edeeeec35ebb02e6f58efb
SHA1

0b2ee0d31fceb7108c0fdbf160ecbc7a0d3f74b1
SHA256

ebd1368979b5adb9586ce512b63876985a497e1727ffbd54732cd42eef992b81
SHA512

a70f52eebca88019ba06c2b22ac0d0119d23a1b7b358c6132d617eb444a76eb299fa2c211c1b83d4d32377aaf62a1e56e90f5c36a0e76456d96a724739a70529
SSDEEP

98304:TOcegIdwqxPLEx6AfWOk3FeCN5RLVzS2pTTDrx9mhgEUwvR:TefGqawAeOk38CrRdvmhtU

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

WMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	5104	WMIC.exe
Token: SeSecurityPrivilege	5104	WMIC.exe
Token: SeTakeOwnershipPrivilege	5104	WMIC.exe
Token: SeLoadDriverPrivilege	5104	WMIC.exe
Token: SeSystemProfilePrivilege	5104	WMIC.exe
Token: SeSystemtimePrivilege	5104	WMIC.exe
Token: SeProfSingleProcessPrivilege	5104	WMIC.exe
Token: SeIncBasePriorityPrivilege	5104	WMIC.exe
Token: SeCreatePagefilePrivilege	5104	WMIC.exe
Token: SeBackupPrivilege	5104	WMIC.exe
Token: SeRestorePrivilege	5104	WMIC.exe
Token: SeShutdownPrivilege	5104	WMIC.exe
Token: SeDebugPrivilege	5104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5104	WMIC.exe
Token: SeRemoteShutdownPrivilege	5104	WMIC.exe
Token: SeUndockPrivilege	5104	WMIC.exe
Token: SeManageVolumePrivilege	5104	WMIC.exe
Token: 33	5104	WMIC.exe
Token: 34	5104	WMIC.exe
Token: 35	5104	WMIC.exe
Token: 36	5104	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5104	WMIC.exe
Token: SeSecurityPrivilege	5104	WMIC.exe
Token: SeTakeOwnershipPrivilege	5104	WMIC.exe
Token: SeLoadDriverPrivilege	5104	WMIC.exe
Token: SeSystemProfilePrivilege	5104	WMIC.exe
Token: SeSystemtimePrivilege	5104	WMIC.exe
Token: SeProfSingleProcessPrivilege	5104	WMIC.exe
Token: SeIncBasePriorityPrivilege	5104	WMIC.exe
Token: SeCreatePagefilePrivilege	5104	WMIC.exe
Token: SeBackupPrivilege	5104	WMIC.exe
Token: SeRestorePrivilege	5104	WMIC.exe
Token: SeShutdownPrivilege	5104	WMIC.exe
Token: SeDebugPrivilege	5104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5104	WMIC.exe
Token: SeRemoteShutdownPrivilege	5104	WMIC.exe
Token: SeUndockPrivilege	5104	WMIC.exe
Token: SeManageVolumePrivilege	5104	WMIC.exe
Token: 33	5104	WMIC.exe
Token: 34	5104	WMIC.exe
Token: 35	5104	WMIC.exe
Token: 36	5104	WMIC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

aurora.execmd.exe

description	pid	process	target process
PID 5112 wrote to memory of 2408	5112	aurora.exe	cmd.exe
PID 5112 wrote to memory of 2408	5112	aurora.exe	cmd.exe
PID 2408 wrote to memory of 5104	2408	cmd.exe	WMIC.exe
PID 2408 wrote to memory of 5104	2408	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\Aurora\aurora.exe
"C:\Users\Admin\AppData\Local\Temp\Aurora\aurora.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5112

C:\Windows\system32\cmd.exe
cmd.exe /c "wmic csproduct get uuid"
2⤵
- Suspicious use of WriteProcessMemory
PID:2408

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5104

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads