46da2d2262661d1f632e86e478642f8e1eb5b5faa65ae34d9039e9ea9efdebaf

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 00:13

Target

44cacd30f4f713101607e1f1f9021f7e.exe
Size

270KB
MD5

44cacd30f4f713101607e1f1f9021f7e
SHA1

69ea3a95361a0e14910e1bdbd5f225aa8b88ab18
SHA256

46da2d2262661d1f632e86e478642f8e1eb5b5faa65ae34d9039e9ea9efdebaf
SHA512

a0e103589d18f53be34c468243492482840e37454e6e03ed085587469edbfd68089e1bf91659acff5287adbe22abc98e4bdb09d2e2664371e3cc0c2941a431b1
SSDEEP

6144:qMhBj6B6kP/KRvA9HmNR92bIjLxPTYra385tnDzeO+SsZPqXhEpJ3:jW6kPIA9mR9jXZkznXL+Cg

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2684	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2312	Hacker.com.cn.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Hacker.com.cn.exe	44cacd30f4f713101607e1f1f9021f7e.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	44cacd30f4f713101607e1f1f9021f7e.exe
File created	C:\Windows\uninstal.bat	44cacd30f4f713101607e1f1f9021f7e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	44cacd30f4f713101607e1f1f9021f7e.exe
Token: SeDebugPrivilege	2312	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2312	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2816	2312	Hacker.com.cn.exe	28
PID 2312 wrote to memory of 2816	2312	Hacker.com.cn.exe	28
PID 2312 wrote to memory of 2816	2312	Hacker.com.cn.exe	28
PID 2312 wrote to memory of 2816	2312	Hacker.com.cn.exe	28
PID 2052 wrote to memory of 2684	2052	44cacd30f4f713101607e1f1f9021f7e.exe	31
PID 2052 wrote to memory of 2684	2052	44cacd30f4f713101607e1f1f9021f7e.exe	31
PID 2052 wrote to memory of 2684	2052	44cacd30f4f713101607e1f1f9021f7e.exe	31
PID 2052 wrote to memory of 2684	2052	44cacd30f4f713101607e1f1f9021f7e.exe	31
PID 2052 wrote to memory of 2684	2052	44cacd30f4f713101607e1f1f9021f7e.exe	31
PID 2052 wrote to memory of 2684	2052	44cacd30f4f713101607e1f1f9021f7e.exe	31
PID 2052 wrote to memory of 2684	2052	44cacd30f4f713101607e1f1f9021f7e.exe	31

C:\Users\Admin\AppData\Local\Temp\44cacd30f4f713101607e1f1f9021f7e.exe
"C:\Users\Admin\AppData\Local\Temp\44cacd30f4f713101607e1f1f9021f7e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  PID:2684

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
1⤵
PID:2816

memory/2052-0-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/2052-4-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2052-1-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/2052-18-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/2312-9-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2312-8-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2312-6-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/2312-20-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2312-21-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download