747e9afdcde670cda400f2340d6b9786fc265c28ee7a60598ff25c6a74cedccd

Analysis

max time kernel
133s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 21:09

Target

f8567f1a01cc2b139a37b8a06b22762d.exe
Size

64KB
MD5

f8567f1a01cc2b139a37b8a06b22762d
SHA1

df8017ac4e7981618bf338149a99e29e97b0a37d
SHA256

747e9afdcde670cda400f2340d6b9786fc265c28ee7a60598ff25c6a74cedccd
SHA512

f82aee5cb22b201e4770528213cbdc899549c8f06b2a4772a573bd4a0dfee099514edd8cb3651c285dc90f73239c4b5d4713e49b9b9a545513c5f5f2cbdfeac7
SSDEEP

768:7zMxAGAc43ydJ+MbPi6Ex2xqvudIgxTLgaUArjRn/:3Z9yrLbP9Ex2xJ3xTUaUArjRn

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	f8567f1a01cc2b139a37b8a06b22762d.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\xcopy.exe	f8567f1a01cc2b139a37b8a06b22762d.exe
File created	C:\Windows\SysWOW64\BFDDos.dll	f8567f1a01cc2b139a37b8a06b22762d.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	f8567f1a01cc2b139a37b8a06b22762d.exe
Token: SeIncBasePriorityPrivilege	2188	f8567f1a01cc2b139a37b8a06b22762d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3472	2188	f8567f1a01cc2b139a37b8a06b22762d.exe	45
PID 2188 wrote to memory of 1724	2188	f8567f1a01cc2b139a37b8a06b22762d.exe	91
PID 2188 wrote to memory of 1724	2188	f8567f1a01cc2b139a37b8a06b22762d.exe	91
PID 2188 wrote to memory of 1724	2188	f8567f1a01cc2b139a37b8a06b22762d.exe	91

C:\Users\Admin\AppData\Local\Temp\f8567f1a01cc2b139a37b8a06b22762d.exe
"C:\Users\Admin\AppData\Local\Temp\f8567f1a01cc2b139a37b8a06b22762d.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\F8567F~1.EXE > nul
  2⤵
  PID:1724