75e6314e846dab2589e54579bbeee2f29a93e568c794afaf867701183e60068c

Analysis

max time kernel
136s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 01:15

Target

1fc2c6faa8a5048e6e51116e05b6ae99.exe
Size

1.0MB
MD5

1fc2c6faa8a5048e6e51116e05b6ae99
SHA1

2413bd755f8806b8d61810c76c5ec910c2500428
SHA256

75e6314e846dab2589e54579bbeee2f29a93e568c794afaf867701183e60068c
SHA512

db2fc84e5abc8c18968cb182aa6d55faf1c91225afe7fbb067622670454af871f7654893a44a3b7107466e7e9c79d78c8e13f903d7606a5168904b05d3d34098
SSDEEP

12288:jjycEBbFEzeJRd4UN3RusTvHztXR2qriw8MdSEltV0uV7k+L7nSrHzwgwHFrO+ke:RE4zeJRGUawRyEV0uxk+L7nQHAlrO82

Score

1^/10

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
216	Reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1380	1fc2c6faa8a5048e6e51116e05b6ae99.exe
1380	1fc2c6faa8a5048e6e51116e05b6ae99.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1380	1fc2c6faa8a5048e6e51116e05b6ae99.exe
Token: SeDebugPrivilege	1380	1fc2c6faa8a5048e6e51116e05b6ae99.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 216	1380	1fc2c6faa8a5048e6e51116e05b6ae99.exe	92
PID 1380 wrote to memory of 216	1380	1fc2c6faa8a5048e6e51116e05b6ae99.exe	92
PID 1380 wrote to memory of 216	1380	1fc2c6faa8a5048e6e51116e05b6ae99.exe	92

C:\Users\Admin\AppData\Local\Temp\1fc2c6faa8a5048e6e51116e05b6ae99.exe
"C:\Users\Admin\AppData\Local\Temp\1fc2c6faa8a5048e6e51116e05b6ae99.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\Reg.exe
  Reg.exe add HKLM\SYSTEM\CurrentControlSet\Services\GbpKm /v Start /t REG_DWORD /d 4 /f
  2⤵
  - Modifies registry key
  PID:216

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1380-0-0x0000000000400000-0x000000000056D000-memory.dmp

Filesize
1.4MB

Download
memory/1380-1-0x0000000000730000-0x0000000000733000-memory.dmp

Filesize
12KB

Download
memory/1380-2-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/1380-3-0x0000000000400000-0x000000000056D000-memory.dmp

Filesize
1.4MB

Download
memory/1380-4-0x0000000000730000-0x0000000000733000-memory.dmp

Filesize
12KB

Download