bbfe0fe3007141df44faec7db1a930169a0bdee1f71ed7f5b8e2e1e3c6800c0c

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cb9b368e317d4ea44000bfb64abca924.exe
Size

532KB
MD5

cb9b368e317d4ea44000bfb64abca924
SHA1

d436511b9fa069d98d947312f1b12252356673b4
SHA256

bbfe0fe3007141df44faec7db1a930169a0bdee1f71ed7f5b8e2e1e3c6800c0c
SHA512

0d159609f35460b58aa846fba6599f5c9b268e83b59cd31ea0f48ce1a2cc2a6cd94df41f290d240de9c7bd9a9cfa1dc17e31848dfc6b421c6cb26434b47dfb43
SSDEEP

12288:pkten5HWfyWEAbuSZhrKvxDHQo30veuBfqUFlh:pAenhWEAbuSbtRGuBiiD

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2876	22qq.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\22qq.exe	cb9b368e317d4ea44000bfb64abca924.exe
File opened for modification	C:\Windows\22qq.exe	cb9b368e317d4ea44000bfb64abca924.exe
File created	C:\Windows\uninstal.bat	cb9b368e317d4ea44000bfb64abca924.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2444	cb9b368e317d4ea44000bfb64abca924.exe
Token: SeDebugPrivilege	2876	22qq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2876	22qq.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 4856	2876	22qq.exe	85
PID 2876 wrote to memory of 4856	2876	22qq.exe	85
PID 2444 wrote to memory of 1676	2444	cb9b368e317d4ea44000bfb64abca924.exe	86
PID 2444 wrote to memory of 1676	2444	cb9b368e317d4ea44000bfb64abca924.exe	86
PID 2444 wrote to memory of 1676	2444	cb9b368e317d4ea44000bfb64abca924.exe	86

C:\Users\Admin\AppData\Local\Temp\cb9b368e317d4ea44000bfb64abca924.exe
"C:\Users\Admin\AppData\Local\Temp\cb9b368e317d4ea44000bfb64abca924.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  PID:1676

C:\Windows\22qq.exe
C:\Windows\22qq.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:4856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\22qq.exe

Filesize
532KB

MD5
cb9b368e317d4ea44000bfb64abca924

SHA1
d436511b9fa069d98d947312f1b12252356673b4

SHA256
bbfe0fe3007141df44faec7db1a930169a0bdee1f71ed7f5b8e2e1e3c6800c0c

SHA512
0d159609f35460b58aa846fba6599f5c9b268e83b59cd31ea0f48ce1a2cc2a6cd94df41f290d240de9c7bd9a9cfa1dc17e31848dfc6b421c6cb26434b47dfb43

Download Submit
C:\Windows\uninstal.bat

Filesize
190B

MD5
f35776e6b99e21f8f39f1bead0f50006

SHA1
a33247c73f13bf48b78ae64a1c1ed40386db24ba

SHA256
5feb647acaf069ed69e6e62dcbc2c676eaee98abe83cec60fb7841cc83d0e1dd

SHA512
051f9b5957d4c716f875b6a768d49000c1033dd1340c7664438440b43ac2fd51f8ce95458c31af455171e3edf7322a009fb911f24811542ffa33e5fe4a0cb44f

Download Submit
memory/2444-16-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/2444-13-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/2444-4-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/2444-5-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/2444-6-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2444-7-0x0000000002A90000-0x0000000002A93000-memory.dmp

Filesize
12KB

Download
memory/2444-8-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/2444-11-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/2444-12-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/2444-2-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/2444-14-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2444-15-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Filesize
4KB

Download
memory/2444-0-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/2444-18-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download
memory/2444-3-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/2444-1-0x0000000000B20000-0x0000000000B6B000-memory.dmp

Filesize
300KB

Download
memory/2444-17-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/2444-32-0x0000000000B20000-0x0000000000B6B000-memory.dmp

Filesize
300KB

Download
memory/2444-31-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/2876-24-0x0000000001640000-0x0000000001641000-memory.dmp

Filesize
4KB

Download
memory/2876-25-0x0000000001630000-0x0000000001631000-memory.dmp

Filesize
4KB

Download
memory/2876-26-0x0000000001620000-0x0000000001621000-memory.dmp

Filesize
4KB

Download
memory/2876-27-0x00000000011C0000-0x00000000011C1000-memory.dmp

Filesize
4KB

Download
memory/2876-28-0x0000000000D20000-0x0000000000D6B000-memory.dmp

Filesize
300KB

Download
memory/2876-23-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2876-22-0x0000000001600000-0x0000000001700000-memory.dmp

Filesize
1024KB

Download
memory/2876-21-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/2876-34-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/2876-35-0x0000000001600000-0x0000000001700000-memory.dmp

Filesize
1024KB

Download