bdb2b87952def04f480267f350e23f2adb86d0b939c83ebf5fd94b48f47a2d45

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2024 19:28

Target

514fa6c138b14b1eb601fff167b9b8c0.exe
Size

352KB
MD5

514fa6c138b14b1eb601fff167b9b8c0
SHA1

f7227c8bf6237f8d3e7cd785e453b47cc3c18d74
SHA256

bdb2b87952def04f480267f350e23f2adb86d0b939c83ebf5fd94b48f47a2d45
SHA512

16e63ccc6c3b6e75ed4f4adbe500b2b78cd81f6a6c75260d839f0c389be9be08ecea3403269f4bdc0ce10acdced93db7c82ad523c64a0160b8a88f742dece0bc
SSDEEP

6144:TbcNnubqTCZRvMnWxL964JGv2aFx4UCCh4Y8T2I6TEKAMwmNccFxroD:PcNuC+h/xAy6tCCOY8T7KRwmSD

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

4492 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

X

pid process

1048 X
Suspicious use of SetThreadContext 1 IoCs

Processes:

514fa6c138b14b1eb601fff167b9b8c0.exe

description pid process target process

PID 2128 set thread context of 4492 2128 514fa6c138b14b1eb601fff167b9b8c0.exe cmd.exe
Modifies registry class 1 IoCs

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings explorer.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

X

pid process

1048 X
1048 X
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

514fa6c138b14b1eb601fff167b9b8c0.exe

description pid process

Token: SeDebugPrivilege 2128 514fa6c138b14b1eb601fff167b9b8c0.exe

pid	process
4492	cmd.exe

pid	process
1048	X

description	pid	process	target process
PID 2128 set thread context of 4492	2128	514fa6c138b14b1eb601fff167b9b8c0.exe	cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	explorer.exe

pid	process
1048	X
1048	X

description	pid	process
Token: SeDebugPrivilege	2128	514fa6c138b14b1eb601fff167b9b8c0.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

514fa6c138b14b1eb601fff167b9b8c0.exeX

description	pid	process	target process
PID 2128 wrote to memory of 1048	2128	514fa6c138b14b1eb601fff167b9b8c0.exe	X
PID 2128 wrote to memory of 1048	2128	514fa6c138b14b1eb601fff167b9b8c0.exe	X
PID 1048 wrote to memory of 2036	1048	X	explorer.exe
PID 1048 wrote to memory of 2036	1048	X	explorer.exe
PID 1048 wrote to memory of 2036	1048	X	explorer.exe
PID 2128 wrote to memory of 4492	2128	514fa6c138b14b1eb601fff167b9b8c0.exe	cmd.exe
PID 2128 wrote to memory of 4492	2128	514fa6c138b14b1eb601fff167b9b8c0.exe	cmd.exe
PID 2128 wrote to memory of 4492	2128	514fa6c138b14b1eb601fff167b9b8c0.exe	cmd.exe
PID 2128 wrote to memory of 4492	2128	514fa6c138b14b1eb601fff167b9b8c0.exe	cmd.exe

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
3⤵
- Modifies registry class
PID:2036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Deletes itself
PID:4492

C:\Users\Admin\AppData\Local\d146a3bf\X
Filesize
41KB

MD5
be40a2578e862f1cecc9b9194f524201

SHA1
0c379f375f9bcfab2e8d86161cec07fe4a7dbc12

SHA256
2c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6

SHA512
25fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8

Download Submit
memory/2036-8-0x0000000000D10000-0x0000000000D18000-memory.dmp

Filesize
32KB

Download
memory/2128-1-0x0000000000400000-0x0000000000469950-memory.dmp

Filesize
422KB

Download
memory/2128-2-0x0000000000980000-0x0000000000A80000-memory.dmp

Filesize
1024KB

Download
memory/2128-9-0x0000000000400000-0x0000000000469950-memory.dmp

Filesize
422KB

Download
memory/2128-11-0x0000000000980000-0x0000000000A80000-memory.dmp

Filesize
1024KB

Download
memory/2128-12-0x0000000000400000-0x0000000000469950-memory.dmp

Filesize
422KB

Download