33b7ab781db25b68797335f9248fad623fdc24267b71749ab2bfca02dd6a29aa

Analysis

max time kernel
134s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e1cba21f7a7b01fbcef46990c41884d.exe
Size

60KB
MD5

7e1cba21f7a7b01fbcef46990c41884d
SHA1

a384951086aa20d842b85f3225b27775333e01d5
SHA256

33b7ab781db25b68797335f9248fad623fdc24267b71749ab2bfca02dd6a29aa
SHA512

8caf1b89425bb0a5f8462d0e892a760b24e2ce7bf59cdfa08798faabbd0201aea96352715acf8fba6bbfb02c0b9bbb383c64c3a6f60a7c2cda593aca67291f8a
SSDEEP

1536:HN8yaTT80wUq63kXSWLu5Oo9RIpzWk1oPz:uya/VkXSWUXoWk1oP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5040	sript.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sript.exe	7e1cba21f7a7b01fbcef46990c41884d.exe
File opened for modification	C:\Windows\SysWOW64\sript.exe	7e1cba21f7a7b01fbcef46990c41884d.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
2132	taskkill.exe
3580	taskkill.exe
3824	taskkill.exe
3496	taskkill.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2136	7e1cba21f7a7b01fbcef46990c41884d.exe
2136	7e1cba21f7a7b01fbcef46990c41884d.exe
2136	7e1cba21f7a7b01fbcef46990c41884d.exe
2136	7e1cba21f7a7b01fbcef46990c41884d.exe
5040	sript.exe
5040	sript.exe
5040	sript.exe
5040	sript.exe
5040	sript.exe
5040	sript.exe
5040	sript.exe
5040	sript.exe
5040	sript.exe
5040	sript.exe
5040	sript.exe
5040	sript.exe
5040	sript.exe
5040	sript.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2136	7e1cba21f7a7b01fbcef46990c41884d.exe
Token: SeDebugPrivilege	2132	taskkill.exe
Token: SeDebugPrivilege	3824	taskkill.exe
Token: SeDebugPrivilege	3580	taskkill.exe
Token: SeDebugPrivilege	3496	taskkill.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2916	2136	7e1cba21f7a7b01fbcef46990c41884d.exe	84
PID 2136 wrote to memory of 2916	2136	7e1cba21f7a7b01fbcef46990c41884d.exe	84
PID 2136 wrote to memory of 2916	2136	7e1cba21f7a7b01fbcef46990c41884d.exe	84
PID 2136 wrote to memory of 4644	2136	7e1cba21f7a7b01fbcef46990c41884d.exe	85
PID 2136 wrote to memory of 4644	2136	7e1cba21f7a7b01fbcef46990c41884d.exe	85
PID 2136 wrote to memory of 4644	2136	7e1cba21f7a7b01fbcef46990c41884d.exe	85
PID 5040 wrote to memory of 4312	5040	sript.exe	89
PID 5040 wrote to memory of 4312	5040	sript.exe	89
PID 5040 wrote to memory of 4312	5040	sript.exe	89
PID 5040 wrote to memory of 2016	5040	sript.exe	90
PID 5040 wrote to memory of 2016	5040	sript.exe	90
PID 5040 wrote to memory of 2016	5040	sript.exe	90
PID 2136 wrote to memory of 4524	2136	7e1cba21f7a7b01fbcef46990c41884d.exe	93
PID 2136 wrote to memory of 4524	2136	7e1cba21f7a7b01fbcef46990c41884d.exe	93
PID 2136 wrote to memory of 4524	2136	7e1cba21f7a7b01fbcef46990c41884d.exe	93
PID 2916 wrote to memory of 2132	2916	cmd.exe	94
PID 2916 wrote to memory of 2132	2916	cmd.exe	94
PID 2916 wrote to memory of 2132	2916	cmd.exe	94
PID 4644 wrote to memory of 3580	4644	cmd.exe	95
PID 4644 wrote to memory of 3580	4644	cmd.exe	95
PID 4644 wrote to memory of 3580	4644	cmd.exe	95
PID 4312 wrote to memory of 3824	4312	cmd.exe	96
PID 4312 wrote to memory of 3824	4312	cmd.exe	96
PID 4312 wrote to memory of 3824	4312	cmd.exe	96
PID 2016 wrote to memory of 3496	2016	cmd.exe	97
PID 2016 wrote to memory of 3496	2016	cmd.exe	97
PID 2016 wrote to memory of 3496	2016	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\7e1cba21f7a7b01fbcef46990c41884d.exe
"C:\Users\Admin\AppData\Local\Temp\7e1cba21f7a7b01fbcef46990c41884d.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwstub.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rfwstub.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwproxy.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rfwproxy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\7E1CBA~1.EXE > nul
  2⤵
  PID:4524

C:\Windows\SysWOW64\sript.exe
C:\Windows\SysWOW64\sript.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwstub.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rfwstub.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwproxy.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rfwproxy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sript.exe

Filesize
60KB

MD5
7e1cba21f7a7b01fbcef46990c41884d

SHA1
a384951086aa20d842b85f3225b27775333e01d5

SHA256
33b7ab781db25b68797335f9248fad623fdc24267b71749ab2bfca02dd6a29aa

SHA512
8caf1b89425bb0a5f8462d0e892a760b24e2ce7bf59cdfa08798faabbd0201aea96352715acf8fba6bbfb02c0b9bbb383c64c3a6f60a7c2cda593aca67291f8a

Download Submit