3326436e204e83cefd388570f5cc2265676e050b0a212857e70da64e90a47c1d

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:34

Target

22f7c1ff853a69ee02e5096c2597cf1c.exe
Size

100KB
MD5

22f7c1ff853a69ee02e5096c2597cf1c
SHA1

0750065764c5b56bd23793bd22fe36a338caaa05
SHA256

3326436e204e83cefd388570f5cc2265676e050b0a212857e70da64e90a47c1d
SHA512

42dd106a55985885478130705c68fe853677ddd85bf3a724bc54e8a2627341fe6dfee526253f49760d5a1d5b0ed97ea0f6c7115fbf8201e0e7ded38f4409a511
SSDEEP

1536:QKY+e0TKbXIIrYtkPprBAqytw8dXrsQ/wFRHB9pNq3Dvftg2yHr:QKetrY6PhKqkw0rsQ/8j9vCftnyHr

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2992	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1916	Svcidcl.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\Svcidcl.exe	22f7c1ff853a69ee02e5096c2597cf1c.exe
File opened for modification	C:\Program Files\Internet Explorer\Svcidcl.exe	22f7c1ff853a69ee02e5096c2597cf1c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2392	22f7c1ff853a69ee02e5096c2597cf1c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2992	2392	22f7c1ff853a69ee02e5096c2597cf1c.exe	29
PID 2392 wrote to memory of 2992	2392	22f7c1ff853a69ee02e5096c2597cf1c.exe	29
PID 2392 wrote to memory of 2992	2392	22f7c1ff853a69ee02e5096c2597cf1c.exe	29
PID 2392 wrote to memory of 2992	2392	22f7c1ff853a69ee02e5096c2597cf1c.exe	29

C:\Users\Admin\AppData\Local\Temp\22f7c1ff853a69ee02e5096c2597cf1c.exe
"C:\Users\Admin\AppData\Local\Temp\22f7c1ff853a69ee02e5096c2597cf1c.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\22F7C1~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2992

C:\Program Files\Internet Explorer\Svcidcl.exe
"C:\Program Files\Internet Explorer\Svcidcl.exe"
1⤵
- Executes dropped EXE
PID:1916

C:\Program Files\Internet Explorer\Svcidcl.exe

Filesize
100KB

MD5
22f7c1ff853a69ee02e5096c2597cf1c

SHA1
0750065764c5b56bd23793bd22fe36a338caaa05

SHA256
3326436e204e83cefd388570f5cc2265676e050b0a212857e70da64e90a47c1d

SHA512
42dd106a55985885478130705c68fe853677ddd85bf3a724bc54e8a2627341fe6dfee526253f49760d5a1d5b0ed97ea0f6c7115fbf8201e0e7ded38f4409a511

Download Submit