79f1b91cad80266a526dafdd0c378de297437588c05ec696988dd3dd757bd4ff

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 15:05

Target

bc1aecb5217e7d948ad2f5a1c2f3c387.exe
Size

48KB
MD5

bc1aecb5217e7d948ad2f5a1c2f3c387
SHA1

4dfaa1540d58ab54e6daf0f5c0a7c1da26b8f28a
SHA256

79f1b91cad80266a526dafdd0c378de297437588c05ec696988dd3dd757bd4ff
SHA512

7952064e2911f16ad21ddbdb60de1fcc0a022b7c2df199469899aa216ec913d2b89283fc421e5e5a9ad1745d94f179f6191c8022f2eb799319953043065c391d
SSDEEP

768:52e3XiBEDwPfUKegZ8tXhP04dNZ2KPlplhn1:52KXbgZ8tXhh/ZNBhn1

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2908	svhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\svhost.exe	bc1aecb5217e7d948ad2f5a1c2f3c387.exe
File opened for modification	C:\Windows\system\svhost.exe	bc1aecb5217e7d948ad2f5a1c2f3c387.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1088	taskkill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2984	1500	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	94
PID 1500 wrote to memory of 2984	1500	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	94
PID 1500 wrote to memory of 2984	1500	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	94
PID 2984 wrote to memory of 1088	2984	cmd.exe	96
PID 2984 wrote to memory of 1088	2984	cmd.exe	96
PID 2984 wrote to memory of 1088	2984	cmd.exe	96
PID 1500 wrote to memory of 2908	1500	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	100
PID 1500 wrote to memory of 2908	1500	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	100
PID 1500 wrote to memory of 2908	1500	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	100
PID 1500 wrote to memory of 3068	1500	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	102
PID 1500 wrote to memory of 3068	1500	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	102
PID 1500 wrote to memory of 3068	1500	bc1aecb5217e7d948ad2f5a1c2f3c387.exe	102

C:\Users\Admin\AppData\Local\Temp\bc1aecb5217e7d948ad2f5a1c2f3c387.exe
"C:\Users\Admin\AppData\Local\Temp\bc1aecb5217e7d948ad2f5a1c2f3c387.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im svhost.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im svhost.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- C:\Windows\system\svhost.exe
  C:\Windows\system\svhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\bc1aecb5217e7d948ad2f5a1c2f3c387.exe"
  2⤵
  PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:8
1⤵
PID:1856

C:\Windows\System\svhost.exe

Filesize
48KB

MD5
bc1aecb5217e7d948ad2f5a1c2f3c387

SHA1
4dfaa1540d58ab54e6daf0f5c0a7c1da26b8f28a

SHA256
79f1b91cad80266a526dafdd0c378de297437588c05ec696988dd3dd757bd4ff

SHA512
7952064e2911f16ad21ddbdb60de1fcc0a022b7c2df199469899aa216ec913d2b89283fc421e5e5a9ad1745d94f179f6191c8022f2eb799319953043065c391d

Download Submit