747e9afdcde670cda400f2340d6b9786fc265c28ee7a60598ff25c6a74cedccd

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 21:09

Target

f8567f1a01cc2b139a37b8a06b22762d.exe
Size

64KB
MD5

f8567f1a01cc2b139a37b8a06b22762d
SHA1

df8017ac4e7981618bf338149a99e29e97b0a37d
SHA256

747e9afdcde670cda400f2340d6b9786fc265c28ee7a60598ff25c6a74cedccd
SHA512

f82aee5cb22b201e4770528213cbdc899549c8f06b2a4772a573bd4a0dfee099514edd8cb3651c285dc90f73239c4b5d4713e49b9b9a545513c5f5f2cbdfeac7
SSDEEP

768:7zMxAGAc43ydJ+MbPi6Ex2xqvudIgxTLgaUArjRn/:3Z9yrLbP9Ex2xJ3xTUaUArjRn

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	f8567f1a01cc2b139a37b8a06b22762d.exe

Deletes itself 1 IoCs

pid	Process
2880	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\xcopy.exe	f8567f1a01cc2b139a37b8a06b22762d.exe
File created	C:\Windows\SysWOW64\BFDDos.dll	f8567f1a01cc2b139a37b8a06b22762d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2476	f8567f1a01cc2b139a37b8a06b22762d.exe
2476	f8567f1a01cc2b139a37b8a06b22762d.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	f8567f1a01cc2b139a37b8a06b22762d.exe
Token: SeIncBasePriorityPrivilege	2476	f8567f1a01cc2b139a37b8a06b22762d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1200	2476	f8567f1a01cc2b139a37b8a06b22762d.exe	7
PID 2476 wrote to memory of 2880	2476	f8567f1a01cc2b139a37b8a06b22762d.exe	28
PID 2476 wrote to memory of 2880	2476	f8567f1a01cc2b139a37b8a06b22762d.exe	28
PID 2476 wrote to memory of 2880	2476	f8567f1a01cc2b139a37b8a06b22762d.exe	28
PID 2476 wrote to memory of 2880	2476	f8567f1a01cc2b139a37b8a06b22762d.exe	28

C:\Users\Admin\AppData\Local\Temp\f8567f1a01cc2b139a37b8a06b22762d.exe
"C:\Users\Admin\AppData\Local\Temp\f8567f1a01cc2b139a37b8a06b22762d.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\F8567F~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2880

memory/1200-1-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download