9672142f683a4994dd8ede46b537d11b65e9782423f35bf2b0dc435512bdf007

Analysis

max time kernel
16s
max time network
22s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 16:22

Target

8QPSTVLAC5IO8.exe
Size

1.0MB
MD5

618becc84857aecef7e13a08f1b2dcae
SHA1

e5389cf14842defafb62f1e4319f7af46fc874a8
SHA256

9672142f683a4994dd8ede46b537d11b65e9782423f35bf2b0dc435512bdf007
SHA512

a355e394dba687ed7ccc376ae3c2472f3fb30f4cecc2dbdb36de1aa9137cb8e62c11ec5f645561a8a4ce38de1ff010f14e0eb850f9966fa5224742d7e75cb23a
SSDEEP

24576:+WnFP2ey/3Y5gIfbGfdufw4oIGiX4J32OMmdiksSZiGJd8QV+FYC6kuJTZ/zbIde:wbYYCnwZLbQUO6

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\libcrypto-3-x64.dll	8QPSTVLAC5IO8.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1736	8QPSTVLAC5IO8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1736	8QPSTVLAC5IO8.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2072	1736	8QPSTVLAC5IO8.exe	29
PID 1736 wrote to memory of 2072	1736	8QPSTVLAC5IO8.exe	29
PID 1736 wrote to memory of 2072	1736	8QPSTVLAC5IO8.exe	29
PID 2072 wrote to memory of 2448	2072	cmd.exe	31
PID 2072 wrote to memory of 2448	2072	cmd.exe	31
PID 2072 wrote to memory of 2448	2072	cmd.exe	31
PID 2072 wrote to memory of 2656	2072	cmd.exe	32
PID 2072 wrote to memory of 2656	2072	cmd.exe	32
PID 2072 wrote to memory of 2656	2072	cmd.exe	32
PID 2072 wrote to memory of 2416	2072	cmd.exe	33
PID 2072 wrote to memory of 2416	2072	cmd.exe	33
PID 2072 wrote to memory of 2416	2072	cmd.exe	33
PID 1736 wrote to memory of 2576	1736	8QPSTVLAC5IO8.exe	34
PID 1736 wrote to memory of 2576	1736	8QPSTVLAC5IO8.exe	34
PID 1736 wrote to memory of 2576	1736	8QPSTVLAC5IO8.exe	34
PID 2576 wrote to memory of 2892	2576	cmd.exe	35
PID 2576 wrote to memory of 2892	2576	cmd.exe	35
PID 2576 wrote to memory of 2892	2576	cmd.exe	35
PID 2576 wrote to memory of 3008	2576	cmd.exe	36
PID 2576 wrote to memory of 3008	2576	cmd.exe	36
PID 2576 wrote to memory of 3008	2576	cmd.exe	36
PID 2576 wrote to memory of 1952	2576	cmd.exe	37
PID 2576 wrote to memory of 1952	2576	cmd.exe	37
PID 2576 wrote to memory of 1952	2576	cmd.exe	37
PID 1736 wrote to memory of 2544	1736	8QPSTVLAC5IO8.exe	38
PID 1736 wrote to memory of 2544	1736	8QPSTVLAC5IO8.exe	38
PID 1736 wrote to memory of 2544	1736	8QPSTVLAC5IO8.exe	38

C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe
"C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe" MD5
    3⤵
    PID:2448
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2656
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe" MD5
    3⤵
    PID:2892
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3008
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1952
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1736 -s 1900
  2⤵
  PID:2544

memory/1736-0-0x0000000036D10000-0x0000000036D20000-memory.dmp

Filesize
64KB

Download