8ae7c872aecf5c721c0d82051fe82b4c94d47a9273fcecb8515c7dab9cad713a

Analysis

max time kernel
158s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 04:41

Target

05bb9d55050b464472e067d202b69030.exe
Size

16KB
MD5

05bb9d55050b464472e067d202b69030
SHA1

47ff4871e417ad0b45d0c56294d82d9493421226
SHA256

8ae7c872aecf5c721c0d82051fe82b4c94d47a9273fcecb8515c7dab9cad713a
SHA512

648944547812e2671ebdabbce9ae6fac78654a28220d3cad9e122a22f9f926f7ac4c9318c6dad3e06b0cacc874d9fd858345d09b85706300f811ee57ac115b17
SSDEEP

192:nqD0yXeZBmtFUk4tb87ZL6lsExDhm2YmtGWrN2ximgFpWWyJkzEnnwkgUw9elgt:u0yZtFUlt40vrfYmTaimgFNLzEnPrg

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\Encionc_ch.dat	05bb9d55050b464472e067d202b69030.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wsconfig.db	05bb9d55050b464472e067d202b69030.exe
File created	C:\Windows\SysWOW64\imm32.dll.bak	05bb9d55050b464472e067d202b69030.exe
File created	C:\Windows\SysWOW64\imm32.dll	05bb9d55050b464472e067d202b69030.exe
File created	C:\Windows\SysWOW64\kb025143239.dll	05bb9d55050b464472e067d202b69030.exe
File opened for modification	C:\Windows\SysWOW64\kb025143239.dll	05bb9d55050b464472e067d202b69030.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
432	05bb9d55050b464472e067d202b69030.exe
432	05bb9d55050b464472e067d202b69030.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	432	05bb9d55050b464472e067d202b69030.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 2540	432	05bb9d55050b464472e067d202b69030.exe	93
PID 432 wrote to memory of 2540	432	05bb9d55050b464472e067d202b69030.exe	93
PID 432 wrote to memory of 2540	432	05bb9d55050b464472e067d202b69030.exe	93

C:\Users\Admin\AppData\Local\Temp\05bb9d55050b464472e067d202b69030.exe
"C:\Users\Admin\AppData\Local\Temp\05bb9d55050b464472e067d202b69030.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\dele57f983.bat
  2⤵
  PID:2540

memory/432-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/432-18-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download