e26b8fb8818391ee573bb87fb2d05eec3b7cf3f833edc9a329ba6cb846012723

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

USystem.exe
Size

717KB
MD5

52e3c254b42572659e8ad466f9d1ef46
SHA1

08db8279d550e590c1fb672b33825fa0cc33b19e
SHA256

e26b8fb8818391ee573bb87fb2d05eec3b7cf3f833edc9a329ba6cb846012723
SHA512

a1a6dd8130fc00cd46e5d5769067f6a230754e62819dd6f23788ee660ac3cf25f3d1c55529b9332428d4a6e39ef92f3563e5bb66e03aa19dda3ac7ea441d4194
SSDEEP

12288:Bh1Lk70TnvjcCQUi4OfTdcSKberuwV9W5dASwQp8vPcM:dk70TrcCLiN4beKEq7IPcM

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4604	USystem.exe
Token: SeIncreaseQuotaPrivilege	4444	WMIC.exe
Token: SeSecurityPrivilege	4444	WMIC.exe
Token: SeTakeOwnershipPrivilege	4444	WMIC.exe
Token: SeLoadDriverPrivilege	4444	WMIC.exe
Token: SeSystemProfilePrivilege	4444	WMIC.exe
Token: SeSystemtimePrivilege	4444	WMIC.exe
Token: SeProfSingleProcessPrivilege	4444	WMIC.exe
Token: SeIncBasePriorityPrivilege	4444	WMIC.exe
Token: SeCreatePagefilePrivilege	4444	WMIC.exe
Token: SeBackupPrivilege	4444	WMIC.exe
Token: SeRestorePrivilege	4444	WMIC.exe
Token: SeShutdownPrivilege	4444	WMIC.exe
Token: SeDebugPrivilege	4444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4444	WMIC.exe
Token: SeRemoteShutdownPrivilege	4444	WMIC.exe
Token: SeUndockPrivilege	4444	WMIC.exe
Token: SeManageVolumePrivilege	4444	WMIC.exe
Token: 33	4444	WMIC.exe
Token: 34	4444	WMIC.exe
Token: 35	4444	WMIC.exe
Token: 36	4444	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4444	WMIC.exe
Token: SeSecurityPrivilege	4444	WMIC.exe
Token: SeTakeOwnershipPrivilege	4444	WMIC.exe
Token: SeLoadDriverPrivilege	4444	WMIC.exe
Token: SeSystemProfilePrivilege	4444	WMIC.exe
Token: SeSystemtimePrivilege	4444	WMIC.exe
Token: SeProfSingleProcessPrivilege	4444	WMIC.exe
Token: SeIncBasePriorityPrivilege	4444	WMIC.exe
Token: SeCreatePagefilePrivilege	4444	WMIC.exe
Token: SeBackupPrivilege	4444	WMIC.exe
Token: SeRestorePrivilege	4444	WMIC.exe
Token: SeShutdownPrivilege	4444	WMIC.exe
Token: SeDebugPrivilege	4444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4444	WMIC.exe
Token: SeRemoteShutdownPrivilege	4444	WMIC.exe
Token: SeUndockPrivilege	4444	WMIC.exe
Token: SeManageVolumePrivilege	4444	WMIC.exe
Token: 33	4444	WMIC.exe
Token: 34	4444	WMIC.exe
Token: 35	4444	WMIC.exe
Token: 36	4444	WMIC.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4856	4604	USystem.exe	92
PID 4604 wrote to memory of 4856	4604	USystem.exe	92
PID 4604 wrote to memory of 4856	4604	USystem.exe	92
PID 4856 wrote to memory of 4444	4856	CMD.exe	94
PID 4856 wrote to memory of 4444	4856	CMD.exe	94
PID 4856 wrote to memory of 4444	4856	CMD.exe	94

C:\Users\Admin\AppData\Local\Temp\USystem.exe
"C:\Users\Admin\AppData\Local\Temp\USystem.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\CMD.exe
  "CMD.exe" /C wmic csproduct get UUID
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get UUID
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4604-0-0x0000000004C60000-0x0000000004D0C000-memory.dmp

Filesize
688KB

Download
memory/4604-1-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/4604-2-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4604-3-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4604-4-0x0000000004DC0000-0x0000000005364000-memory.dmp

Filesize
5.6MB

Download
memory/4604-5-0x0000000005370000-0x000000000541A000-memory.dmp

Filesize
680KB

Download
memory/4604-6-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-7-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-9-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-11-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-13-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-15-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-17-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-19-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-21-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-23-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-25-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-31-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-29-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-33-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-27-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-35-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-37-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-39-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-41-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-43-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-45-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-47-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-49-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-51-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-53-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-55-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-57-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-59-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-61-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-63-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-65-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-67-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-69-0x0000000005370000-0x0000000005414000-memory.dmp

Filesize
656KB

Download
memory/4604-956-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4604-957-0x0000000002770000-0x0000000002771000-memory.dmp

Filesize
4KB

Download
memory/4604-958-0x0000000004D10000-0x0000000004DA2000-memory.dmp

Filesize
584KB

Download
memory/4604-959-0x0000000005590000-0x000000000559A000-memory.dmp

Filesize
40KB

Download
memory/4604-960-0x00000000061B0000-0x0000000006240000-memory.dmp

Filesize
576KB

Download
memory/4604-961-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4604-962-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/4604-963-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4604-964-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4604-965-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads