e5813de67eb6f3bf8976528d985cf2a2f67640a5e5e330cf8d0aad33e74448e1

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 23:29

Target

87f2990b3bd138ef759b10b31ef3d130.exe
Size

644KB
MD5

87f2990b3bd138ef759b10b31ef3d130
SHA1

600d02844c443e584d80bc5cde94123f40479dd4
SHA256

e5813de67eb6f3bf8976528d985cf2a2f67640a5e5e330cf8d0aad33e74448e1
SHA512

3d281e81dc0bed6be3b9fabb3e990aac899023d148fa3d1892ea75d76011a905ad0c64aa1d3304cdc6d579edc6fd9b3f1d93ae39e6df803fba4806c78fcc1976
SSDEEP

12288:k3423hel9QQwW5AP7j34lIJrpqaAEh39UOTpl5Tq63Bvo2Xq3+6lr:k3jR5QwW5ATs0rsUh39UO73Bvo2Xw

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1816	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2516	G_Server1.23.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\G_Server1.23.exe	87f2990b3bd138ef759b10b31ef3d130.exe
File created	C:\Windows\Delete.bAt	87f2990b3bd138ef759b10b31ef3d130.exe
File created	C:\Windows\G_Server1.23.exe	87f2990b3bd138ef759b10b31ef3d130.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	G_Server1.23.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\System	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	G_Server1.23.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	G_Server1.23.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	87f2990b3bd138ef759b10b31ef3d130.exe
Token: SeDebugPrivilege	2516	G_Server1.23.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	G_Server1.23.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2104	2516	G_Server1.23.exe	29
PID 2516 wrote to memory of 2104	2516	G_Server1.23.exe	29
PID 2516 wrote to memory of 2104	2516	G_Server1.23.exe	29
PID 2516 wrote to memory of 2104	2516	G_Server1.23.exe	29
PID 2868 wrote to memory of 1816	2868	87f2990b3bd138ef759b10b31ef3d130.exe	30
PID 2868 wrote to memory of 1816	2868	87f2990b3bd138ef759b10b31ef3d130.exe	30
PID 2868 wrote to memory of 1816	2868	87f2990b3bd138ef759b10b31ef3d130.exe	30
PID 2868 wrote to memory of 1816	2868	87f2990b3bd138ef759b10b31ef3d130.exe	30

C:\Users\Admin\AppData\Local\Temp\87f2990b3bd138ef759b10b31ef3d130.exe
"C:\Users\Admin\AppData\Local\Temp\87f2990b3bd138ef759b10b31ef3d130.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\Delete.bAt
  2⤵
  - Deletes itself
  PID:1816

C:\Windows\G_Server1.23.exe
C:\Windows\G_Server1.23.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2516
- C:\pROGRAM fILES\iNTERNET eXPLORER\iexplore.exe
  "C:\pROGRAM fILES\iNTERNET eXPLORER\iexplore.exe"
  2⤵
  PID:2104

C:\Windows\Delete.bAt

Filesize
186B

MD5
5f572014a670f089dbee2b7cf6bd1a2a

SHA1
e739c2a6cf638faf39194a2da74a6a2ce4d18971

SHA256
614469ba863610cb2387113b3ed3867c45f4026289d24d53a6e452ceb5bebb61

SHA512
84f2dbc0df0335afbe87166903be4441dd21603d9217d5b7da0077ec7bdaf8d6a9168059ed7782d5ed21a9ed285c75db723b3981ece75406b739fb6cdf7c9469

Download Submit
C:\Windows\G_Server1.23.exe

Filesize
644KB

MD5
87f2990b3bd138ef759b10b31ef3d130

SHA1
600d02844c443e584d80bc5cde94123f40479dd4

SHA256
e5813de67eb6f3bf8976528d985cf2a2f67640a5e5e330cf8d0aad33e74448e1

SHA512
3d281e81dc0bed6be3b9fabb3e990aac899023d148fa3d1892ea75d76011a905ad0c64aa1d3304cdc6d579edc6fd9b3f1d93ae39e6df803fba4806c78fcc1976

Download Submit
memory/2516-4-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2516-15-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2516-17-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2868-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2868-13-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download