72868ade3b34bb7a205963a166a56392f2aa889036481c3a27435273db54df24

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 14:32

Target

b4eeea8f4234fb822b735b5dc011cc2b.exe
Size

744KB
MD5

b4eeea8f4234fb822b735b5dc011cc2b
SHA1

496d358081cb5fcc29164c72298126d351dfc89d
SHA256

72868ade3b34bb7a205963a166a56392f2aa889036481c3a27435273db54df24
SHA512

14cdacf90ad93b8d9d7f612b1740d81b9ac6c1046b5c1fec8713144608ef45b95c2509b712bfb3058ee23cd81573e65066fb523f5424a3d4d2d1aa8f1f2e9706
SSDEEP

12288:MRygSktU4g/n/t0EW5A0zymvJwQ5oAlK+G6Kv+QIk6AQQ52LvRg0865wVbH9:QptU4gf2EW5A2RJr/kIKvFIk6zX+

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2376	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2948	360Safe.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\360safe\360Safe.exe	b4eeea8f4234fb822b735b5dc011cc2b.exe
File opened for modification	C:\Program Files\360safe\360Safe.exe	b4eeea8f4234fb822b735b5dc011cc2b.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\uninstal.bat	b4eeea8f4234fb822b735b5dc011cc2b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 0	1812	b4eeea8f4234fb822b735b5dc011cc2b.exe
Token: 0	2948	360Safe.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2948	360Safe.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2512	2948	360Safe.exe	29
PID 2948 wrote to memory of 2512	2948	360Safe.exe	29
PID 2948 wrote to memory of 2512	2948	360Safe.exe	29
PID 2948 wrote to memory of 2512	2948	360Safe.exe	29
PID 1812 wrote to memory of 2376	1812	b4eeea8f4234fb822b735b5dc011cc2b.exe	30
PID 1812 wrote to memory of 2376	1812	b4eeea8f4234fb822b735b5dc011cc2b.exe	30
PID 1812 wrote to memory of 2376	1812	b4eeea8f4234fb822b735b5dc011cc2b.exe	30
PID 1812 wrote to memory of 2376	1812	b4eeea8f4234fb822b735b5dc011cc2b.exe	30
PID 1812 wrote to memory of 2376	1812	b4eeea8f4234fb822b735b5dc011cc2b.exe	30
PID 1812 wrote to memory of 2376	1812	b4eeea8f4234fb822b735b5dc011cc2b.exe	30
PID 1812 wrote to memory of 2376	1812	b4eeea8f4234fb822b735b5dc011cc2b.exe	30

C:\Users\Admin\AppData\Local\Temp\b4eeea8f4234fb822b735b5dc011cc2b.exe
"C:\Users\Admin\AppData\Local\Temp\b4eeea8f4234fb822b735b5dc011cc2b.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  PID:2376

C:\Program Files\360safe\360Safe.exe
"C:\Program Files\360safe\360Safe.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2512

C:\Program Files\360safe\360Safe.exe

Filesize
744KB

MD5
b4eeea8f4234fb822b735b5dc011cc2b

SHA1
496d358081cb5fcc29164c72298126d351dfc89d

SHA256
72868ade3b34bb7a205963a166a56392f2aa889036481c3a27435273db54df24

SHA512
14cdacf90ad93b8d9d7f612b1740d81b9ac6c1046b5c1fec8713144608ef45b95c2509b712bfb3058ee23cd81573e65066fb523f5424a3d4d2d1aa8f1f2e9706

Download Submit
C:\Windows\uninstal.bat

Filesize
190B

MD5
d532741e608df3185362fbac87cd61ee

SHA1
55c2ad0ba02fc294c36f0cd81685b5cc3b09b576

SHA256
6573ba25d559566c6f8c4461c6fd32e199fffb282b5a4bc86de1efe753ddee8c

SHA512
efa7159bb2b652b788dc2e3713f3c91964eeca847d3cac482968da67c68116248e671d8ebb0a09b4d7574b61b3883b480380b298772671d7f412161c102775e9

Download Submit
memory/1812-0-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/1812-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1812-15-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/2948-5-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/2948-6-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2948-17-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/2948-19-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download