a235c1f7963c83bbf2bdef425eb6f618446afa6f40fde075a21029ac0a853c2e

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 14:46

Target

0209a4e555ed7df3fb6cd315022cf20b.exe
Size

39KB
MD5

0209a4e555ed7df3fb6cd315022cf20b
SHA1

86ea56de23225a9c8a9ab3e03851765ea9d8c76f
SHA256

a235c1f7963c83bbf2bdef425eb6f618446afa6f40fde075a21029ac0a853c2e
SHA512

432d70f6260342ad2c8cd78d16e92680283a520a1210fd432f75d80dd2f2a2d605de5be7932ee7c7c43ef1f681020fbf5743602e5849fd893ad394d8a9947740
SSDEEP

768:AXdZbSvLHsaDh8noZz2m7LsB089yvYvBWje8YLgWiLSege83/sv43:AXGD5ooV2NB0QvBWrWLTp3/U4

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2252	cmd.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winnet.dll	0209a4e555ed7df3fb6cd315022cf20b.exe
File created	C:\Windows\SysWOW64\winnet.bmp	0209a4e555ed7df3fb6cd315022cf20b.exe
File created	C:\Windows\SysWOW64\winnet.exe	0209a4e555ed7df3fb6cd315022cf20b.exe
File opened for modification	C:\Windows\SysWOW64\winnet.exe	0209a4e555ed7df3fb6cd315022cf20b.exe
File opened for modification	C:\Windows\SysWOW64\xcopy.exe	0209a4e555ed7df3fb6cd315022cf20b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2236	0209a4e555ed7df3fb6cd315022cf20b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2252	2236	0209a4e555ed7df3fb6cd315022cf20b.exe	28
PID 2236 wrote to memory of 2252	2236	0209a4e555ed7df3fb6cd315022cf20b.exe	28
PID 2236 wrote to memory of 2252	2236	0209a4e555ed7df3fb6cd315022cf20b.exe	28
PID 2236 wrote to memory of 2252	2236	0209a4e555ed7df3fb6cd315022cf20b.exe	28

C:\Users\Admin\AppData\Local\Temp\0209a4e555ed7df3fb6cd315022cf20b.exe
"C:\Users\Admin\AppData\Local\Temp\0209a4e555ed7df3fb6cd315022cf20b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\0209A4~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2252