9c216ca074eff0fe66a134a978b883bc27b7ac3d5f29f951e90f0dac980deb61

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 15:57

Target

7ac932c877a80bd981598f37ccdf1e6c.exe
Size

703KB
MD5

7ac932c877a80bd981598f37ccdf1e6c
SHA1

8204d408d56a590a2dcb629739815112dbd9a16e
SHA256

9c216ca074eff0fe66a134a978b883bc27b7ac3d5f29f951e90f0dac980deb61
SHA512

721ec8b29681b5144df78efa7ce9f1b867532543491181b0613fa278d2b9d3d88363a819d7fd32959b953217e10cbf5c887ac4d17ed7c344f8c60e3ac1f24cbc
SSDEEP

12288:YRycYktU4g/n/t0EW5A0ckOvJwQ5oalK+Geh4v6jIk6bQQ52LwRg08S5nt1/Pk:cxnU4gf2EW5AdHJr1kMh4vOIk6LXlH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1952	NoHacker.cn.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\NoHacker.cn.exe	7ac932c877a80bd981598f37ccdf1e6c.exe
File created	C:\Windows\NoHacker.cn.exe	7ac932c877a80bd981598f37ccdf1e6c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	7ac932c877a80bd981598f37ccdf1e6c.exe
Token: SeDebugPrivilege	1952	NoHacker.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	NoHacker.cn.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2868	1952	NoHacker.cn.exe	57
PID 1952 wrote to memory of 2868	1952	NoHacker.cn.exe	57

C:\Windows\NoHacker.cn.exe
C:\Windows\NoHacker.cn.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2868

C:\Windows\NoHacker.cn.exe

Filesize
703KB

MD5
7ac932c877a80bd981598f37ccdf1e6c

SHA1
8204d408d56a590a2dcb629739815112dbd9a16e

SHA256
9c216ca074eff0fe66a134a978b883bc27b7ac3d5f29f951e90f0dac980deb61

SHA512
721ec8b29681b5144df78efa7ce9f1b867532543491181b0613fa278d2b9d3d88363a819d7fd32959b953217e10cbf5c887ac4d17ed7c344f8c60e3ac1f24cbc

Download Submit
memory/1952-6-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/1952-8-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/1952-9-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2756-0-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/2756-1-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/2756-7-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download