e26b8fb8818391ee573bb87fb2d05eec3b7cf3f833edc9a329ba6cb846012723

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

USystem.exe
Size

717KB
MD5

52e3c254b42572659e8ad466f9d1ef46
SHA1

08db8279d550e590c1fb672b33825fa0cc33b19e
SHA256

e26b8fb8818391ee573bb87fb2d05eec3b7cf3f833edc9a329ba6cb846012723
SHA512

a1a6dd8130fc00cd46e5d5769067f6a230754e62819dd6f23788ee660ac3cf25f3d1c55529b9332428d4a6e39ef92f3563e5bb66e03aa19dda3ac7ea441d4194
SSDEEP

12288:Bh1Lk70TnvjcCQUi4OfTdcSKberuwV9W5dASwQp8vPcM:dk70TrcCLiN4beKEq7IPcM

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	USystem.exe
Token: SeIncreaseQuotaPrivilege	1968	WMIC.exe
Token: SeSecurityPrivilege	1968	WMIC.exe
Token: SeTakeOwnershipPrivilege	1968	WMIC.exe
Token: SeLoadDriverPrivilege	1968	WMIC.exe
Token: SeSystemProfilePrivilege	1968	WMIC.exe
Token: SeSystemtimePrivilege	1968	WMIC.exe
Token: SeProfSingleProcessPrivilege	1968	WMIC.exe
Token: SeIncBasePriorityPrivilege	1968	WMIC.exe
Token: SeCreatePagefilePrivilege	1968	WMIC.exe
Token: SeBackupPrivilege	1968	WMIC.exe
Token: SeRestorePrivilege	1968	WMIC.exe
Token: SeShutdownPrivilege	1968	WMIC.exe
Token: SeDebugPrivilege	1968	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1968	WMIC.exe
Token: SeRemoteShutdownPrivilege	1968	WMIC.exe
Token: SeUndockPrivilege	1968	WMIC.exe
Token: SeManageVolumePrivilege	1968	WMIC.exe
Token: 33	1968	WMIC.exe
Token: 34	1968	WMIC.exe
Token: 35	1968	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1968	WMIC.exe
Token: SeSecurityPrivilege	1968	WMIC.exe
Token: SeTakeOwnershipPrivilege	1968	WMIC.exe
Token: SeLoadDriverPrivilege	1968	WMIC.exe
Token: SeSystemProfilePrivilege	1968	WMIC.exe
Token: SeSystemtimePrivilege	1968	WMIC.exe
Token: SeProfSingleProcessPrivilege	1968	WMIC.exe
Token: SeIncBasePriorityPrivilege	1968	WMIC.exe
Token: SeCreatePagefilePrivilege	1968	WMIC.exe
Token: SeBackupPrivilege	1968	WMIC.exe
Token: SeRestorePrivilege	1968	WMIC.exe
Token: SeShutdownPrivilege	1968	WMIC.exe
Token: SeDebugPrivilege	1968	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1968	WMIC.exe
Token: SeRemoteShutdownPrivilege	1968	WMIC.exe
Token: SeUndockPrivilege	1968	WMIC.exe
Token: SeManageVolumePrivilege	1968	WMIC.exe
Token: 33	1968	WMIC.exe
Token: 34	1968	WMIC.exe
Token: 35	1968	WMIC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 536	2892	USystem.exe	28
PID 2892 wrote to memory of 536	2892	USystem.exe	28
PID 2892 wrote to memory of 536	2892	USystem.exe	28
PID 2892 wrote to memory of 536	2892	USystem.exe	28
PID 536 wrote to memory of 1968	536	CMD.exe	30
PID 536 wrote to memory of 1968	536	CMD.exe	30
PID 536 wrote to memory of 1968	536	CMD.exe	30
PID 536 wrote to memory of 1968	536	CMD.exe	30

C:\Users\Admin\AppData\Local\Temp\USystem.exe
"C:\Users\Admin\AppData\Local\Temp\USystem.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\CMD.exe
  "CMD.exe" /C wmic csproduct get UUID
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get UUID
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2892-0-0x00000000048A0000-0x000000000494C000-memory.dmp

Filesize
688KB

Download
memory/2892-1-0x0000000073E30000-0x000000007451E000-memory.dmp

Filesize
6.9MB

Download
memory/2892-2-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download
memory/2892-3-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download
memory/2892-4-0x00000000047F0000-0x000000000489A000-memory.dmp

Filesize
680KB

Download
memory/2892-5-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-6-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-8-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-10-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-12-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-14-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-16-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-18-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-20-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-22-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-24-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-26-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-28-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-30-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-32-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-34-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-36-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-38-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-40-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-42-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-44-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-46-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-48-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-50-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-52-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-54-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-56-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-58-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-60-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-64-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-62-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-66-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-68-0x00000000047F0000-0x0000000004894000-memory.dmp

Filesize
656KB

Download
memory/2892-955-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download
memory/2892-956-0x0000000001E80000-0x0000000001E81000-memory.dmp

Filesize
4KB

Download
memory/2892-957-0x00000000053B0000-0x0000000005440000-memory.dmp

Filesize
576KB

Download
memory/2892-958-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download
memory/2892-959-0x0000000073E30000-0x000000007451E000-memory.dmp

Filesize
6.9MB

Download
memory/2892-960-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download
memory/2892-961-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download
memory/2892-962-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads