79f1b91cad80266a526dafdd0c378de297437588c05ec696988dd3dd757bd4ff

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 15:05

Target

bc1aecb5217e7d948ad2f5a1c2f3c387.exe
Size

48KB
MD5

bc1aecb5217e7d948ad2f5a1c2f3c387
SHA1

4dfaa1540d58ab54e6daf0f5c0a7c1da26b8f28a
SHA256

79f1b91cad80266a526dafdd0c378de297437588c05ec696988dd3dd757bd4ff
SHA512

7952064e2911f16ad21ddbdb60de1fcc0a022b7c2df199469899aa216ec913d2b89283fc421e5e5a9ad1745d94f179f6191c8022f2eb799319953043065c391d
SSDEEP

768:52e3XiBEDwPfUKegZ8tXhP04dNZ2KPlplhn1:52KXbgZ8tXhh/ZNBhn1

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2608	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2524	svhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2304	bc1aecb5217e7d948ad2f5a1c2f3c387.exe
2304	bc1aecb5217e7d948ad2f5a1c2f3c387.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\svhost.exe	bc1aecb5217e7d948ad2f5a1c2f3c387.exe
File opened for modification	C:\Windows\system\svhost.exe	bc1aecb5217e7d948ad2f5a1c2f3c387.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2868	taskkill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2368	2304	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	28
PID 2304 wrote to memory of 2368	2304	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	28
PID 2304 wrote to memory of 2368	2304	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	28
PID 2304 wrote to memory of 2368	2304	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	28
PID 2368 wrote to memory of 2868	2368	cmd.exe	30
PID 2368 wrote to memory of 2868	2368	cmd.exe	30
PID 2368 wrote to memory of 2868	2368	cmd.exe	30
PID 2368 wrote to memory of 2868	2368	cmd.exe	30
PID 2304 wrote to memory of 2524	2304	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	32
PID 2304 wrote to memory of 2524	2304	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	32
PID 2304 wrote to memory of 2524	2304	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	32
PID 2304 wrote to memory of 2524	2304	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	32
PID 2304 wrote to memory of 2608	2304	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	34
PID 2304 wrote to memory of 2608	2304	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	34
PID 2304 wrote to memory of 2608	2304	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	34
PID 2304 wrote to memory of 2608	2304	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	34

C:\Users\Admin\AppData\Local\Temp\bc1aecb5217e7d948ad2f5a1c2f3c387.exe
"C:\Users\Admin\AppData\Local\Temp\bc1aecb5217e7d948ad2f5a1c2f3c387.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im svhost.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im svhost.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- C:\Windows\system\svhost.exe
  C:\Windows\system\svhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\bc1aecb5217e7d948ad2f5a1c2f3c387.exe"
  2⤵
  - Deletes itself
  PID:2608

\Windows\system\svhost.exe

Filesize
48KB

MD5
bc1aecb5217e7d948ad2f5a1c2f3c387

SHA1
4dfaa1540d58ab54e6daf0f5c0a7c1da26b8f28a

SHA256
79f1b91cad80266a526dafdd0c378de297437588c05ec696988dd3dd757bd4ff

SHA512
7952064e2911f16ad21ddbdb60de1fcc0a022b7c2df199469899aa216ec913d2b89283fc421e5e5a9ad1745d94f179f6191c8022f2eb799319953043065c391d

Download Submit