dc207762edb90234600c83ebc767324c5b729de06040066e0a28e723c92d32de

Analysis

max time kernel
143s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2023, 05:33

Target

Local/Win64/Tools/Diagnostics/ETW/Driver/RegisterCustomerManifest.bat
Size

428B
MD5

f5314a68e0060772e6f2233ba7c278bb
SHA1

e7371fb3bb37f18a01258b2b52247db7ee09c078
SHA256

ea1fe0bc9b01d26db4c8ab0a16df54a1812e0f74efb00389f7cc5f4fbd443a0e
SHA512

002ffb080b173c68cc5eaa9f534034ff7bcafcdd78d31dc175c09be8d7c1a4c6ab06d55f1bb2b297085f68a9c20633ff56dc61192d55694e44289087596cc49a

Score

8^/10

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\IntelWiFiDriverEtw_driver_customer.dll	xcopy.exe
File opened for modification	C:\Windows\system32\drivers\IntelWiFiDriverEtw_driver_customer.dll	xcopy.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers	xcopy.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3668	4656	cmd.exe	87
PID 4656 wrote to memory of 3668	4656	cmd.exe	87
PID 4656 wrote to memory of 448	4656	cmd.exe	88
PID 4656 wrote to memory of 448	4656	cmd.exe	88
PID 4656 wrote to memory of 4612	4656	cmd.exe	89
PID 4656 wrote to memory of 4612	4656	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Local\Win64\Tools\Diagnostics\ETW\Driver\RegisterCustomerManifest.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\system32\wevtutil.exe
  wevtutil um WlanDriverEventsCustomer.man
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3668
- C:\Windows\system32\xcopy.exe
  xcopy ..\..\RESOURCES\IntelWiFiDriverEtw_driver_customer.dll C:\Windows\system32\drivers\ /Y /I
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  PID:448
- C:\Windows\system32\wevtutil.exe
  wevtutil im WlanDriverEventsCustomer.man /rf:C:\Windows\system32\drivers\IntelWiFiDriverEtw_driver_customer.dll /mf:C:\Windows\system32\drivers\IntelWiFiDriverEtw_driver_customer.dll
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4612

C:\Windows\system32\drivers\IntelWiFiDriverEtw_driver_customer.dll

Filesize
36KB

MD5
d8d17f379acff08eb8f5dcd596a791eb

SHA1
9975b8183e054f9e3e83750429e45d2ae1d4c15f

SHA256
af39831be318e6e663886d44ad321d3dbe0414b92aff867c4bc870ae99eaea65

SHA512
ce8d9c4d99ae8393da303877c35e707ff2ae2894165d6138d4cbfccd70abfa2f39fc0a220a9652a7a72b282018c7741b07e8ed3825e27a474cc8213a610b0dfa

Download Submit