bae2b33899b46ac07b23f9485b3805e68fac0ffd95591b61e6694225550cbd97

Analysis

max time kernel
143s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:07

Target

15603002a75772b007adfed1afab1633.exe
Size

331KB
MD5

15603002a75772b007adfed1afab1633
SHA1

6830ec187875817cd6aba3ad0da0295415fca7ac
SHA256

bae2b33899b46ac07b23f9485b3805e68fac0ffd95591b61e6694225550cbd97
SHA512

4ba04aa46eb00b595bee1df2f9489382e9e40c16f41aa07f2520dbe971186a428d567fc604564c40dec5410ef1cf708997ffcede909bc45ceece715bb68add48
SSDEEP

6144:aTsuf2nqhr51q+pBMyl4MZRhX7nQTdz2FE5gDM1Bm+t0zl5nO:5qhNM+pBp4MZRhX7nSF2W5gA0zD

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2096	rundll

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2224-0-0x0000000000400000-0x00000000004CF208-memory.dmp	upx
behavioral1/files/0x000b000000012243-4.dat	upx
behavioral1/memory/2096-5-0x0000000000400000-0x00000000004CF208-memory.dmp	upx
behavioral1/memory/2224-8-0x0000000000400000-0x00000000004CF208-memory.dmp	upx
behavioral1/memory/2096-9-0x0000000000400000-0x00000000004CF208-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\rundll	15603002a75772b007adfed1afab1633.exe
File opened for modification	C:\Program Files (x86)\rundll	15603002a75772b007adfed1afab1633.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	15603002a75772b007adfed1afab1633.exe
Token: SeDebugPrivilege	2096	rundll

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	rundll

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2660	2096	rundll	29
PID 2096 wrote to memory of 2660	2096	rundll	29
PID 2096 wrote to memory of 2660	2096	rundll	29
PID 2096 wrote to memory of 2660	2096	rundll	29

C:\Program Files (x86)\rundll
"C:\Program Files (x86)\rundll"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2660

C:\Program Files (x86)\rundll

Filesize
331KB

MD5
15603002a75772b007adfed1afab1633

SHA1
6830ec187875817cd6aba3ad0da0295415fca7ac

SHA256
bae2b33899b46ac07b23f9485b3805e68fac0ffd95591b61e6694225550cbd97

SHA512
4ba04aa46eb00b595bee1df2f9489382e9e40c16f41aa07f2520dbe971186a428d567fc604564c40dec5410ef1cf708997ffcede909bc45ceece715bb68add48

Download Submit
memory/2096-5-0x0000000000400000-0x00000000004CF208-memory.dmp

Filesize
828KB

Download
memory/2096-6-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2096-9-0x0000000000400000-0x00000000004CF208-memory.dmp

Filesize
828KB

Download
memory/2096-11-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2224-0-0x0000000000400000-0x00000000004CF208-memory.dmp

Filesize
828KB

Download
memory/2224-1-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2224-8-0x0000000000400000-0x00000000004CF208-memory.dmp

Filesize
828KB

Download