53aeaffe63305cb272b26a45a1b6ca0921a0feb3ec0d3772c34b8354ceb80e6c

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 16:56

Target

b7e7d8a59c75a9fe54d53ce80661cf7d.exe
Size

132KB
MD5

b7e7d8a59c75a9fe54d53ce80661cf7d
SHA1

90994cc3e0daaa99e04c680072ebc41790e392c4
SHA256

53aeaffe63305cb272b26a45a1b6ca0921a0feb3ec0d3772c34b8354ceb80e6c
SHA512

68c5b9b3484056c2a81d9390cdc0a3c3ae2d6fc9b257eb819320887dbf4f65864f856771fd9b7876f237121465c934534a5fc27b438cb441748063f1506f1680
SSDEEP

3072:VSPktYmvwgtTBfCQNUYMYDMclLoW9BR9wjJrjr:wciqwgtTBqnN2lLo+2Hr

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4008	vjikux.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vjikux.exe	b7e7d8a59c75a9fe54d53ce80661cf7d.exe
File opened for modification	C:\Windows\SysWOW64\vjikux.exe	b7e7d8a59c75a9fe54d53ce80661cf7d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2468	b7e7d8a59c75a9fe54d53ce80661cf7d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 4972	2468	b7e7d8a59c75a9fe54d53ce80661cf7d.exe	89
PID 2468 wrote to memory of 4972	2468	b7e7d8a59c75a9fe54d53ce80661cf7d.exe	89
PID 2468 wrote to memory of 4972	2468	b7e7d8a59c75a9fe54d53ce80661cf7d.exe	89

C:\Users\Admin\AppData\Local\Temp\b7e7d8a59c75a9fe54d53ce80661cf7d.exe
"C:\Users\Admin\AppData\Local\Temp\b7e7d8a59c75a9fe54d53ce80661cf7d.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\B7E7D8~1.EXE > nul
  2⤵
  PID:4972

C:\Windows\SysWOW64\vjikux.exe
C:\Windows\SysWOW64\vjikux.exe
1⤵
- Executes dropped EXE
PID:4008

C:\Windows\SysWOW64\vjikux.exe

Filesize
132KB

MD5
b7e7d8a59c75a9fe54d53ce80661cf7d

SHA1
90994cc3e0daaa99e04c680072ebc41790e392c4

SHA256
53aeaffe63305cb272b26a45a1b6ca0921a0feb3ec0d3772c34b8354ceb80e6c

SHA512
68c5b9b3484056c2a81d9390cdc0a3c3ae2d6fc9b257eb819320887dbf4f65864f856771fd9b7876f237121465c934534a5fc27b438cb441748063f1506f1680

Download Submit
memory/2468-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2468-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download