6ca52315ca17b81c46c0f2bd930deb8fc295a78e81a30f03bcaf3f330b3b8a22

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 12:32

Target

1ea1904254b5424dcd3a07b0adf607f0.exe
Size

283KB
MD5

1ea1904254b5424dcd3a07b0adf607f0
SHA1

35ea55804a79e772d00766edc02b375df74eeb8a
SHA256

6ca52315ca17b81c46c0f2bd930deb8fc295a78e81a30f03bcaf3f330b3b8a22
SHA512

46a60c8a8a42e63fa4ba32b4db7c8fa28342ad9dbdf78cf49ef74cdd8b968d0ba16e72597da6d9b67416d2b9bfeda3bce298856c83ebd5ec1776bf23f2f781f4
SSDEEP

6144:tl5L7Q+1b+Nz65JvoanBCiIrRtEEztQZ/hmmeRg:P5L8akz6YjiIrbxtQZ/9eRg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3476	ASP.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ASP.exe	1ea1904254b5424dcd3a07b0adf607f0.exe
File created	C:\Windows\uninstal.bat	1ea1904254b5424dcd3a07b0adf607f0.exe
File created	C:\Windows\ASP.exe	1ea1904254b5424dcd3a07b0adf607f0.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ASP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ASP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ASP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ASP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ASP.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4960	1ea1904254b5424dcd3a07b0adf607f0.exe
Token: SeDebugPrivilege	3476	ASP.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3476	ASP.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 3752	4960	1ea1904254b5424dcd3a07b0adf607f0.exe	94
PID 4960 wrote to memory of 3752	4960	1ea1904254b5424dcd3a07b0adf607f0.exe	94
PID 4960 wrote to memory of 3752	4960	1ea1904254b5424dcd3a07b0adf607f0.exe	94
PID 3476 wrote to memory of 3280	3476	ASP.exe	92
PID 3476 wrote to memory of 3280	3476	ASP.exe	92

C:\Users\Admin\AppData\Local\Temp\1ea1904254b5424dcd3a07b0adf607f0.exe
"C:\Users\Admin\AppData\Local\Temp\1ea1904254b5424dcd3a07b0adf607f0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  PID:3752

C:\Windows\ASP.exe
C:\Windows\ASP.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:3280

C:\Windows\ASP.exe

Filesize
283KB

MD5
1ea1904254b5424dcd3a07b0adf607f0

SHA1
35ea55804a79e772d00766edc02b375df74eeb8a

SHA256
6ca52315ca17b81c46c0f2bd930deb8fc295a78e81a30f03bcaf3f330b3b8a22

SHA512
46a60c8a8a42e63fa4ba32b4db7c8fa28342ad9dbdf78cf49ef74cdd8b968d0ba16e72597da6d9b67416d2b9bfeda3bce298856c83ebd5ec1776bf23f2f781f4

Download Submit
C:\Windows\uninstal.bat

Filesize
190B

MD5
54f6724a8e27f71d7bd5912cfe07f358

SHA1
e8fc77ee22f6f10bb8caa19fde8c80c347265afb

SHA256
4c914704de58621dc82762b69b77e7c77f964a1338e4d422181967e0292c613d

SHA512
66235e5b88cc239dc236a29a269a1551fee5875f519fbbaa63000613bf1876b765245f8978afde7f063232ebd00f2bce426f7d930dc9f5c999b6161062cb4183

Download Submit
memory/3476-8-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/3476-12-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/3476-13-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/4960-0-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/4960-4-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/4960-1-0x0000000002280000-0x000000000228A000-memory.dmp

Filesize
40KB

Download
memory/4960-10-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download