3326436e204e83cefd388570f5cc2265676e050b0a212857e70da64e90a47c1d

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 01:34

Target

22f7c1ff853a69ee02e5096c2597cf1c.exe
Size

100KB
MD5

22f7c1ff853a69ee02e5096c2597cf1c
SHA1

0750065764c5b56bd23793bd22fe36a338caaa05
SHA256

3326436e204e83cefd388570f5cc2265676e050b0a212857e70da64e90a47c1d
SHA512

42dd106a55985885478130705c68fe853677ddd85bf3a724bc54e8a2627341fe6dfee526253f49760d5a1d5b0ed97ea0f6c7115fbf8201e0e7ded38f4409a511
SSDEEP

1536:QKY+e0TKbXIIrYtkPprBAqytw8dXrsQ/wFRHB9pNq3Dvftg2yHr:QKetrY6PhKqkw0rsQ/8j9vCftnyHr

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
492	Svceqlu.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\Svceqlu.exe	22f7c1ff853a69ee02e5096c2597cf1c.exe
File opened for modification	C:\Program Files\Internet Explorer\Svceqlu.exe	22f7c1ff853a69ee02e5096c2597cf1c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1512	22f7c1ff853a69ee02e5096c2597cf1c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 3380	1512	22f7c1ff853a69ee02e5096c2597cf1c.exe	90
PID 1512 wrote to memory of 3380	1512	22f7c1ff853a69ee02e5096c2597cf1c.exe	90
PID 1512 wrote to memory of 3380	1512	22f7c1ff853a69ee02e5096c2597cf1c.exe	90

C:\Users\Admin\AppData\Local\Temp\22f7c1ff853a69ee02e5096c2597cf1c.exe
"C:\Users\Admin\AppData\Local\Temp\22f7c1ff853a69ee02e5096c2597cf1c.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\22F7C1~1.EXE > nul
  2⤵
  PID:3380

C:\Program Files\Internet Explorer\Svceqlu.exe
"C:\Program Files\Internet Explorer\Svceqlu.exe"
1⤵
- Executes dropped EXE
PID:492

C:\Program Files\Internet Explorer\Svceqlu.exe

Filesize
100KB

MD5
22f7c1ff853a69ee02e5096c2597cf1c

SHA1
0750065764c5b56bd23793bd22fe36a338caaa05

SHA256
3326436e204e83cefd388570f5cc2265676e050b0a212857e70da64e90a47c1d

SHA512
42dd106a55985885478130705c68fe853677ddd85bf3a724bc54e8a2627341fe6dfee526253f49760d5a1d5b0ed97ea0f6c7115fbf8201e0e7ded38f4409a511

Download Submit