60be59aeeaf9fa9bb65cf1a10bec08207be1edadb68b7c5fa35537bad6d08f32

Analysis

max time kernel
143s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5050cf2d809d1dc9476a57215b45f01d.exe
Size

634KB
MD5

5050cf2d809d1dc9476a57215b45f01d
SHA1

af79e050a11ae839fdd68e861653c6a970e4d3b9
SHA256

60be59aeeaf9fa9bb65cf1a10bec08207be1edadb68b7c5fa35537bad6d08f32
SHA512

857ab55bb4ca9161489908aad372191ab796341e672af47de018acc6dbb4c388c3e4335166fdea69a507c7524e7c12375d8b4939cf56401f5cbc3450d165ded1
SSDEEP

12288:9IlPEo6nhZu2ahOThx5nJB/dV17rRQR5qF3Z4mxxUUUpbca+MZLlZM2s6HM0:ST8HuVkhx5ndT7rSqQmXw1cJgLlZkD0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2588	Hacker.com.cn.ini

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Hacker.com.cn.ini	5050cf2d809d1dc9476a57215b45f01d.exe
File opened for modification	C:\Windows\Hacker.com.cn.ini	5050cf2d809d1dc9476a57215b45f01d.exe
File created	C:\Windows\uninstal.bat	5050cf2d809d1dc9476a57215b45f01d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	5050cf2d809d1dc9476a57215b45f01d.exe
Token: SeDebugPrivilege	2588	Hacker.com.cn.ini

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2588	Hacker.com.cn.ini

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 3164	2200	5050cf2d809d1dc9476a57215b45f01d.exe	57
PID 2200 wrote to memory of 3164	2200	5050cf2d809d1dc9476a57215b45f01d.exe	57
PID 2200 wrote to memory of 3164	2200	5050cf2d809d1dc9476a57215b45f01d.exe	57

C:\Users\Admin\AppData\Local\Temp\5050cf2d809d1dc9476a57215b45f01d.exe
"C:\Users\Admin\AppData\Local\Temp\5050cf2d809d1dc9476a57215b45f01d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  PID:3164

C:\Windows\Hacker.com.cn.ini
C:\Windows\Hacker.com.cn.ini
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-4-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/2200-3-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/2200-19-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/2200-18-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2200-17-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/2200-16-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2200-15-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/2200-14-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/2200-13-0x0000000003600000-0x0000000003601000-memory.dmp

Filesize
4KB

Download
memory/2200-12-0x0000000003500000-0x0000000003503000-memory.dmp

Filesize
12KB

Download
memory/2200-11-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2200-10-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/2200-9-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/2200-8-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/2200-6-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/2200-5-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2200-7-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/2200-2-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/2200-0-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2200-1-0x00000000022F0000-0x0000000002344000-memory.dmp

Filesize
336KB

Download
memory/2200-35-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2200-36-0x00000000022F0000-0x0000000002344000-memory.dmp

Filesize
336KB

Download
memory/2588-31-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/2588-30-0x0000000000A50000-0x0000000000AA4000-memory.dmp

Filesize
336KB

Download
memory/2588-29-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/2588-28-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/2588-27-0x00000000020B0000-0x00000000020B1000-memory.dmp

Filesize
4KB

Download
memory/2588-26-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2588-25-0x0000000002080000-0x0000000002081000-memory.dmp

Filesize
4KB

Download
memory/2588-32-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/2588-24-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2588-38-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/2588-39-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download