7592428ef31a712ca8cb3b0deae050c54bd114c5b26f2816a9f009d3d0f9aa7d

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 04:50

Target

4fa15e284357982627d86b49381fe11b.exe
Size

65KB
MD5

4fa15e284357982627d86b49381fe11b
SHA1

8f54b5a8a0ff525d1ec2295af2e57e58466b0ce7
SHA256

7592428ef31a712ca8cb3b0deae050c54bd114c5b26f2816a9f009d3d0f9aa7d
SHA512

4564bd8e433b2ef187eb8ec31d31370f088522039e60d1d65b873efa0f37afd2baeefc1025f7a7a3fcef704f2209bf6f78417b711dd8f5ea28aefc43a5d64a14
SSDEEP

1536:/PEMIZc37LFind5QOXJKozjJAgagk1hBcUMV0d4GZWK:XGILFQPQOoWALfrMV0d4GZWK

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2456	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2552	mscfco.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mscfco.exe	4fa15e284357982627d86b49381fe11b.exe
File created	C:\Windows\SysWOW64\mscfco.exe	4fa15e284357982627d86b49381fe11b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2552	mscfco.exe
2552	mscfco.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	mscfco.exe
Token: SeDebugPrivilege	2552	mscfco.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 612	2552	mscfco.exe	30
PID 1904 wrote to memory of 2456	1904	4fa15e284357982627d86b49381fe11b.exe	16
PID 1904 wrote to memory of 2456	1904	4fa15e284357982627d86b49381fe11b.exe	16
PID 1904 wrote to memory of 2456	1904	4fa15e284357982627d86b49381fe11b.exe	16
PID 1904 wrote to memory of 2456	1904	4fa15e284357982627d86b49381fe11b.exe	16

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Deleteme.bat
1⤵
- Deletes itself
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:612

C:\Users\Admin\AppData\Local\Temp\Deleteme.bat

Filesize
184B

MD5
22a33a44ddcb77b6d23633fffd17611b

SHA1
f78939205e963f0ec5cdb8bebd2b77061a26ccec

SHA256
1b9db0679e4d97f0c09858a93451352829824aad689c6eea38f823328c510a98

SHA512
823f3310a9d2ffc9f1700fdeab84051715501c2bbe8b117a96b23baf03ede074571d1f90f01201a20f9c1b40be7001e05e7807b9f351d8e717c66f2988fc05a5

Download Submit
C:\Windows\SysWOW64\mscfco.exe

Filesize
65KB

MD5
4fa15e284357982627d86b49381fe11b

SHA1
8f54b5a8a0ff525d1ec2295af2e57e58466b0ce7

SHA256
7592428ef31a712ca8cb3b0deae050c54bd114c5b26f2816a9f009d3d0f9aa7d

SHA512
4564bd8e433b2ef187eb8ec31d31370f088522039e60d1d65b873efa0f37afd2baeefc1025f7a7a3fcef704f2209bf6f78417b711dd8f5ea28aefc43a5d64a14

Download Submit
memory/612-9-0x0000000029820000-0x0000000029836000-memory.dmp

Filesize
88KB

Download
memory/1904-13-0x0000000029820000-0x0000000029836000-memory.dmp

Filesize
88KB

Download
memory/2552-12-0x0000000029820000-0x0000000029836000-memory.dmp

Filesize
88KB

Download