2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Size

389KB
MD5

83a8dec3edcea3adb5e0552111462688
SHA1

09b454c88dae576cd49402034d538c35d7d42420
SHA256

2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12
SHA512

363104c63bb46e7eed02dbe79587b342a8eba21d1d30574c1c69abf3b1b950c2a6d8aab7151589f62ba226c08b45a28ffee9dbc92babb03e8b879008f505cd06
SSDEEP

6144:glTptK8sX6zWf0G+TP/XXVeXC8X3cO9bOXX3xl:ejGOdl

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeIncreaseQuotaPrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeSecurityPrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeTakeOwnershipPrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeLoadDriverPrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeSystemProfilePrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeSystemtimePrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeProfSingleProcessPrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeIncBasePriorityPrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeCreatePagefilePrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeBackupPrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeRestorePrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeShutdownPrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeDebugPrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeSystemEnvironmentPrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeRemoteShutdownPrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeUndockPrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: SeManageVolumePrivilege	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: 33	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: 34	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: 35	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
Token: 36	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 2280	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe	84
PID 4176 wrote to memory of 2280	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe	84
PID 4176 wrote to memory of 4568	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe	87
PID 4176 wrote to memory of 4568	4176	2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe	87

C:\Users\Admin\AppData\Local\Temp\2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe
"C:\Users\Admin\AppData\Local\Temp\2c88530955b8912cd4f62ce86cabe2c98462c60fab5fce6626a78b29d36b9e12.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /FO CSV /v
  2⤵
  PID:2280
- C:\Windows\system32\findstr.exe
  "C:\Windows\system32\findstr.exe" c:\windows
  2⤵
  PID:4568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qhrkjsnr.y11.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4176-133-0x0000000000C00000-0x0000000000C64000-memory.dmp

Filesize
400KB

Download
memory/4176-143-0x00007FF87A0C0000-0x00007FF87AB81000-memory.dmp

Filesize
10.8MB

Download
memory/4176-144-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/4176-145-0x000000001C3B0000-0x000000001C3D2000-memory.dmp

Filesize
136KB

Download
memory/4176-146-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/4176-149-0x00007FF87A0C0000-0x00007FF87AB81000-memory.dmp

Filesize
10.8MB

Download