5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6

Analysis

max time kernel
141s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2023, 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe
Size

198KB
MD5

37e080c0637ecd7a0a4b5bdb34bff43b
SHA1

34f006f2eeece42cf1c0e18b4c35f3905c257240
SHA256

5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6
SHA512

ef1cfd96e4e5c0b72f0d9aea263c80b1d328ac97c77a0c054fe7777e238cf1926fd106535fb96e295a7409eebc849b7ba110d17a053fc1bb9823beda159b2aad
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOK:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXD

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2580	igkhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\igkhost.exe	5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe
File opened for modification	C:\Windows\Debug\igkhost.exe	5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1940	5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 3880	1940	5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe	83
PID 1940 wrote to memory of 3880	1940	5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe	83
PID 1940 wrote to memory of 3880	1940	5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe	83

C:\Users\Admin\AppData\Local\Temp\5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe
"C:\Users\Admin\AppData\Local\Temp\5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5ACF91~1.EXE > nul
  2⤵
  PID:3880

C:\Windows\Debug\igkhost.exe
C:\Windows\Debug\igkhost.exe
1⤵
- Executes dropped EXE
PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\igkhost.exe

Filesize
198KB

MD5
db1a6520e25ad462172d16c1b493949b

SHA1
413fe5d90f4e9f3e4faf2ef6246e9ae1637cfc45

SHA256
0a8d193197eb86f12128a06771e6fd0945bab4b98da1920a85025bb0522c9aa8

SHA512
bf7714e6194af88f96b941b6ced1ff28466bc21a83eba05b4636d1234316bf5c7127be25271e4adad0d3fed694e58a7560bcf25f250f96267abbd95e00dae726

Download Submit
C:\Windows\debug\igkhost.exe

Filesize
198KB

MD5
db1a6520e25ad462172d16c1b493949b

SHA1
413fe5d90f4e9f3e4faf2ef6246e9ae1637cfc45

SHA256
0a8d193197eb86f12128a06771e6fd0945bab4b98da1920a85025bb0522c9aa8

SHA512
bf7714e6194af88f96b941b6ced1ff28466bc21a83eba05b4636d1234316bf5c7127be25271e4adad0d3fed694e58a7560bcf25f250f96267abbd95e00dae726

Download Submit