b5e595f70f317fc0c3916b7f0294681db744ec05ab7013cfb770c1f656018c8e

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
22/06/2023, 06:38

Target
SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe
Size 418KB
Sample230622-hd2spsch62
SHA256 b5e595f70f317fc0c3916b7f0294681db744ec05ab7013cfb770c1f656018c8e
MD5 37b418b14ad3491d55e1e3669838ab69
SHA1 67db39a82a7c4c930482ac74dd768d57b9ea990c
SHA512 2c578adf598d4d89b9fe2f5cec4649093c671c06c3c8a260f6e8bf789d7bcec5287d458f07effcc2ade4e5c8fb9583a2d68798d685cd4347b15b7cea209b5a3f
SSDEEP 6144:jTjPJaPJaHJamfaeCaTq9j10dx5tPNtbusqfIRzmzT9w4KRKIdcZAGiW:LJ8J0J/TqR1MtPb6sqmzmzxeAILZW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anydesk.exe.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anydesk.exe.exe	Powershell.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
764	1064	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1720	Powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	Powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1720	1064	SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe	28
PID 1064 wrote to memory of 1720	1064	SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe	28
PID 1064 wrote to memory of 1720	1064	SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe	28
PID 1064 wrote to memory of 1720	1064	SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe	28
PID 1064 wrote to memory of 468	1064	SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe	30
PID 1064 wrote to memory of 468	1064	SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe	30
PID 1064 wrote to memory of 468	1064	SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe	30
PID 1064 wrote to memory of 468	1064	SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe	30
PID 1064 wrote to memory of 764	1064	SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe	31
PID 1064 wrote to memory of 764	1064	SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe	31
PID 1064 wrote to memory of 764	1064	SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe	31
PID 1064 wrote to memory of 764	1064	SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anydesk.exe.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe"
  2⤵
  PID:468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 640
  2⤵
  - Program crash
  PID:764

memory/1064-54-0x0000000000260000-0x00000000002D0000-memory.dmp

Download

memory/1064-55-0x0000000000490000-0x00000000004DA000-memory.dmp

Download

memory/1064-56-0x0000000004EA0000-0x0000000004EE0000-memory.dmp

Download

memory/1064-61-0x0000000000310000-0x000000000031A000-memory.dmp

Download

memory/1064-63-0x0000000004EA0000-0x0000000004EE0000-memory.dmp

Download

memory/1720-59-0x0000000002670000-0x00000000026B0000-memory.dmp

Download

memory/1720-60-0x0000000002670000-0x00000000026B0000-memory.dmp

Download