fb27a8f334ce468be1c7085433fa4553df1ac2bdc84573183c1adb58a9f77727

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 19:28

Target

Sign.exe
Size

10KB
MD5

b18f2b99d7ce903a148c7e546a26a748
SHA1

a6c45f978c21c1aed97e90c04372a92a86aaa31a
SHA256

fb27a8f334ce468be1c7085433fa4553df1ac2bdc84573183c1adb58a9f77727
SHA512

24674cce626deb0cee3872525d843b268ead1d23c203e477b03d98ca67d91918f6797c57fb0ac412b6f1707e21468626c463517a59fce3153c9b23106fe36075
SSDEEP

96:jwas6qGR9s5jfdQMKJ6PIMDoDyWSAQfdnurEkZvYYoesPQbKxup+zYYD/C7t:jwG19s5j26PDDoOhRulWY2PQGup+

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4232	Sign.exe
4232	Sign.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3168	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4232	Sign.exe
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 3168	4232	Sign.exe	54
PID 3168 wrote to memory of 2708	3168	Explorer.EXE	82
PID 3168 wrote to memory of 2708	3168	Explorer.EXE	82

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Users\Admin\AppData\Local\Temp\Sign.exe
  "C:\Users\Admin\AppData\Local\Temp\Sign.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\1.bat
  2⤵
  PID:2708

memory/3168-0-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/3168-2-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download