248ff44d78dda2d93a669bb7537b57fe271d243d1cb5bf6615276debc28a704c

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:17

Target

26151dd2af6c3f572d15b54ff58e1b04.exe
Size

67KB
MD5

26151dd2af6c3f572d15b54ff58e1b04
SHA1

2c659efb3fd57a4f0b1603b740765c4b1c6cf9d8
SHA256

248ff44d78dda2d93a669bb7537b57fe271d243d1cb5bf6615276debc28a704c
SHA512

16864879a1fe7e6e704987c56acc3c0c7f74857d326199f84298cbcc16a42bebefbe48a0502be6ba0ea992e17ec209a4dba62268f52a4b082fe7fc5d0e0000d0
SSDEEP

1536:Im2w31fUGq+ALnEVqSGSX41ZNcPlOJfJjfRa06tx8JzSKlen5mQsthSVqbOe+:Im1lfsLnEVzX0Znf9Rux8JeoSmQsthcl

Score

8^/10

upx

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\beep.sys	26151dd2af6c3f572d15b54ff58e1b04.exe

Deletes itself 1 IoCs

pid	Process
2460	cmd.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/624-0-0x0000000000400000-0x000000000042EDF8-memory.dmp	upx
behavioral1/memory/624-1-0x0000000000400000-0x000000000042EDF8-memory.dmp	upx
behavioral1/memory/624-5-0x0000000000400000-0x000000000042EDF8-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\nbjs.dll	26151dd2af6c3f572d15b54ff58e1b04.exe
File opened for modification	C:\Windows\SysWOW64\nbjs.dll	26151dd2af6c3f572d15b54ff58e1b04.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	624	26151dd2af6c3f572d15b54ff58e1b04.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2460	624	26151dd2af6c3f572d15b54ff58e1b04.exe	28
PID 624 wrote to memory of 2460	624	26151dd2af6c3f572d15b54ff58e1b04.exe	28
PID 624 wrote to memory of 2460	624	26151dd2af6c3f572d15b54ff58e1b04.exe	28
PID 624 wrote to memory of 2460	624	26151dd2af6c3f572d15b54ff58e1b04.exe	28

C:\Users\Admin\AppData\Local\Temp\26151dd2af6c3f572d15b54ff58e1b04.exe
"C:\Users\Admin\AppData\Local\Temp\26151dd2af6c3f572d15b54ff58e1b04.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\26151D~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2460

memory/624-0-0x0000000000400000-0x000000000042EDF8-memory.dmp

Filesize
187KB

Download
memory/624-1-0x0000000000400000-0x000000000042EDF8-memory.dmp

Filesize
187KB

Download
memory/624-5-0x0000000000400000-0x000000000042EDF8-memory.dmp

Filesize
187KB

Download