786ebec06367c2e9e240ba9aa4b04af8cf5303e2fd24646d629b4db20f43023d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 08:11

Target
b439514daba38054fad7f4c21ea35117.exe
Size 34KB
Sample240305-j3e6nsbb57
SHA256 786ebec06367c2e9e240ba9aa4b04af8cf5303e2fd24646d629b4db20f43023d
MD5 b439514daba38054fad7f4c21ea35117
SHA1 209dc9fda4bcc86a6fa152277b90c467fc63012a
SHA512 43f1f1697a39b0975eb4cea0d972e76e1cf0d7b0fb5745aa5a5f9ffa46225483f233f6282bb19238171fe2b59328c8d1c010427825f0b9b5950f4675e1811615
SSDEEP 768:JasF23ai4BQP9p5RG/CN+QJM55Tq2EmFTaA2qxLha5Z:JRoHP/rShajkK
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rsaauto.bak	b439514daba38054fad7f4c21ea35117.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\systom32\	b439514daba38054fad7f4c21ea35117.exe
File created	C:\Windows\systom32\svchost.exe	b439514daba38054fad7f4c21ea35117.exe
File opened for modification	C:\Windows\systom32\svchost.exe	b439514daba38054fad7f4c21ea35117.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeRestorePrivilege	2948	b439514daba38054fad7f4c21ea35117.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 624	2948	b439514daba38054fad7f4c21ea35117.exe	88
PID 2948 wrote to memory of 624	2948	b439514daba38054fad7f4c21ea35117.exe	88
PID 2948 wrote to memory of 624	2948	b439514daba38054fad7f4c21ea35117.exe	88

C:\Users\Admin\AppData\Local\Temp\b439514daba38054fad7f4c21ea35117.exe
"C:\Users\Admin\AppData\Local\Temp\b439514daba38054fad7f4c21ea35117.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c afc9fe2f418b00a0.bat
  2⤵
  PID:624

afc9fe2f418b00a0.bat

Path C:\Users\Admin\AppData\Local\Temp\afc9fe2f418b00a0.bat
Size 2KB
SHA256 fe8705138b1d9512c77987bd94b96a67c4275fb182bb0a7fde3f1e46053c7cb2
MD5 3557a85c92c6c59bc21d5f18b116b917
SHA1 2e0daa774471a133832e244b5a12d86fd0a904a1
SHA512 a893448899276f288f382bcc361d1256469d60d437cba6ef8639c7f7f3584e503b48fd0a34edcb3b1adb0d25fdcc92d01fe17e257ecc5034b00e7d504371e3fa
MD5 SHA1 SHA512

Submit Download

memory/2948-0-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2948-8-0x0000000000400000-0x0000000000419000-memory.dmp

Download