67e68d1933e87f680f063203e7e243c33deba2dfdbcd2bb08e9205d3fff26fb8

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 18:51

Target

2222-main/token.exe
Size

7KB
MD5

a35189bbe526f95125f313585a23c091
SHA1

571507b33c3bb4641562e86f66fab4068a807067
SHA256

97ffdd15bd339158c3569a1183d8d42250932c262a570bf230db6e741b5eb815
SHA512

b233916b3c56bf62098cda4a82f3e234ce9dbe20d60d055d6743464d0d75ab4890006327ea45c8f38f08284616f01f373ebe2a260b75cc1d0a74e2dae42169c5
SSDEEP

96:qGhDBU9ZsETvsxblLSP8+Uqngf02CyZcFKfgfdlfBzNt:qGcoET1P8+UqVwfgFlfD

Score

6^/10

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 wtfismyip.com
4 wtfismyip.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2800 2360 WerFault.exe token.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

token.exe

pid process

2360 token.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

token.exe

description pid process

Token: SeDebugPrivilege 2360 token.exe

flow	ioc
5	wtfismyip.com
4	wtfismyip.com

pid	pid_target	process	target process
2800	2360	WerFault.exe	token.exe

pid	process
2360	token.exe

description	pid	process
Token: SeDebugPrivilege	2360	token.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

token.exe

description	pid	process	target process
PID 2360 wrote to memory of 2800	2360	token.exe	WerFault.exe
PID 2360 wrote to memory of 2800	2360	token.exe	WerFault.exe
PID 2360 wrote to memory of 2800	2360	token.exe	WerFault.exe
PID 2360 wrote to memory of 2800	2360	token.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2222-main\token.exe
"C:\Users\Admin\AppData\Local\Temp\2222-main\token.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 1244
  2⤵
  - Program crash
  PID:2800

memory/2360-0-0x0000000000030000-0x0000000000038000-memory.dmp

Filesize
32KB

Download
memory/2360-1-0x0000000074810000-0x0000000074EFE000-memory.dmp

Filesize
6.9MB

Download
memory/2360-2-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Filesize
256KB

Download
memory/2360-3-0x0000000074810000-0x0000000074EFE000-memory.dmp

Filesize
6.9MB

Download
memory/2360-4-0x0000000004CD0000-0x0000000004D10000-memory.dmp

Filesize
256KB

Download