388ad819640a7cadc0a0fa669d30deea191a4918ad6e677b41f04b54c7b4a28e

Analysis

max time kernel
132s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:12

Target

74f0e077f6d09858a83842228e59d85b.exe
Size

14KB
MD5

74f0e077f6d09858a83842228e59d85b
SHA1

d98e00ac316432b91349973ce3fefc2bf8e9b9a7
SHA256

388ad819640a7cadc0a0fa669d30deea191a4918ad6e677b41f04b54c7b4a28e
SHA512

760b8e018fb38ad2c42e36f0628cc7b02c1dd4e469dea47bfe3199acaedc685c36b42b511d4f99f07c579b5c115ff92609b3c7a48353f26ef1ab297cf85801c5
SSDEEP

384:tfoA1MPda3BPCKGTd4yhGdAd0g8Sp9u7zJrAfzV:twaMVa3BPO4wsrAJ

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1464 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

74f0e077f6d09858a83842228e59d85b.exe

pid process

2792 74f0e077f6d09858a83842228e59d85b.exe

pid	process
1464	cmd.exe

pid	process
2792	74f0e077f6d09858a83842228e59d85b.exe

Drops file in System32 directory 2 IoCs

Processes:

74f0e077f6d09858a83842228e59d85b.exe

description	ioc	process
File created	C:\Windows\SysWOW64\74f0e077f6d09858a83842228e59d85b.exe	74f0e077f6d09858a83842228e59d85b.exe
File opened for modification	C:\Windows\SysWOW64\74f0e077f6d09858a83842228e59d85b.exe	74f0e077f6d09858a83842228e59d85b.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

74f0e077f6d09858a83842228e59d85b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

74f0e077f6d09858a83842228e59d85b.exe

description pid process

Token: SeIncBasePriorityPrivilege 2032 74f0e077f6d09858a83842228e59d85b.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2032	74f0e077f6d09858a83842228e59d85b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

74f0e077f6d09858a83842228e59d85b.exe

description	pid	process	target process
PID 2032 wrote to memory of 1464	2032	74f0e077f6d09858a83842228e59d85b.exe	cmd.exe
PID 2032 wrote to memory of 1464	2032	74f0e077f6d09858a83842228e59d85b.exe	cmd.exe
PID 2032 wrote to memory of 1464	2032	74f0e077f6d09858a83842228e59d85b.exe	cmd.exe
PID 2032 wrote to memory of 1464	2032	74f0e077f6d09858a83842228e59d85b.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\74F0E0~1.EXE > nul
2⤵
- Deletes itself
PID:1464

C:\Windows\SysWOW64\74f0e077f6d09858a83842228e59d85b.exe
C:\Windows\SysWOW64\74f0e077f6d09858a83842228e59d85b.exe
1⤵
- Executes dropped EXE
PID:2792

C:\Windows\SysWOW64\74f0e077f6d09858a83842228e59d85b.exe
Filesize
14KB

MD5
74f0e077f6d09858a83842228e59d85b

SHA1
d98e00ac316432b91349973ce3fefc2bf8e9b9a7

SHA256
388ad819640a7cadc0a0fa669d30deea191a4918ad6e677b41f04b54c7b4a28e

SHA512
760b8e018fb38ad2c42e36f0628cc7b02c1dd4e469dea47bfe3199acaedc685c36b42b511d4f99f07c579b5c115ff92609b3c7a48353f26ef1ab297cf85801c5

Download Submit
memory/2032-1-0x0000000000400000-0x00000000004467C2-memory.dmp

Filesize
281KB

Download
memory/2032-6-0x0000000000400000-0x00000000004467C2-memory.dmp

Filesize
281KB

Download
memory/2792-4-0x0000000000400000-0x00000000004467C2-memory.dmp

Filesize
281KB

Download
memory/2792-7-0x0000000000400000-0x00000000004467C2-memory.dmp

Filesize
281KB

Download