53ea7c6dab0d1216300db433356ffdf3a52a2863c8a613f5ddeb1dc23813b462

Analysis

max time kernel
74s
max time network
140s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:50

Target

14f3c2ca9a36200a69ec835f1dbdd0a8.exe
Size

128KB
MD5

14f3c2ca9a36200a69ec835f1dbdd0a8
SHA1

303465bd52300e9ed92acf6badc091c35e909387
SHA256

53ea7c6dab0d1216300db433356ffdf3a52a2863c8a613f5ddeb1dc23813b462
SHA512

800954796ef36383c45f604459b1357c9b1803568d63fbaaf6f49780c4be2cdc1e161a310196619798f26566fe774a709947a983087b31d035144fdf81247bd4
SSDEEP

3072:NInFft2DayoSf9lIQvt7XSY8g+xwbUxjA:KFAay1l/17d8gpbajA

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2084	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2156	ggmiuy.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ggmiuy.exe	14f3c2ca9a36200a69ec835f1dbdd0a8.exe
File opened for modification	C:\Windows\SysWOW64\ggmiuy.exe	14f3c2ca9a36200a69ec835f1dbdd0a8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1708	14f3c2ca9a36200a69ec835f1dbdd0a8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2084	1708	14f3c2ca9a36200a69ec835f1dbdd0a8.exe	29
PID 1708 wrote to memory of 2084	1708	14f3c2ca9a36200a69ec835f1dbdd0a8.exe	29
PID 1708 wrote to memory of 2084	1708	14f3c2ca9a36200a69ec835f1dbdd0a8.exe	29
PID 1708 wrote to memory of 2084	1708	14f3c2ca9a36200a69ec835f1dbdd0a8.exe	29

C:\Users\Admin\AppData\Local\Temp\14f3c2ca9a36200a69ec835f1dbdd0a8.exe
"C:\Users\Admin\AppData\Local\Temp\14f3c2ca9a36200a69ec835f1dbdd0a8.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\14F3C2~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2084

C:\Windows\SysWOW64\ggmiuy.exe
C:\Windows\SysWOW64\ggmiuy.exe
1⤵
- Executes dropped EXE
PID:2156

C:\Windows\SysWOW64\ggmiuy.exe

Filesize
128KB

MD5
14f3c2ca9a36200a69ec835f1dbdd0a8

SHA1
303465bd52300e9ed92acf6badc091c35e909387

SHA256
53ea7c6dab0d1216300db433356ffdf3a52a2863c8a613f5ddeb1dc23813b462

SHA512
800954796ef36383c45f604459b1357c9b1803568d63fbaaf6f49780c4be2cdc1e161a310196619798f26566fe774a709947a983087b31d035144fdf81247bd4

Download Submit
memory/2156-4-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download