5e68f197b77ca12d4d4060a3879fa3d9cfb0a239c194b3598fd1cfd8c2d5215f

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 15:10

Target
cbbac547efe9564dd5b0cb6cb9b7c3bd.exe
Size 32KB
Sample240315-sj38tsdf44
SHA256 5e68f197b77ca12d4d4060a3879fa3d9cfb0a239c194b3598fd1cfd8c2d5215f
MD5 cbbac547efe9564dd5b0cb6cb9b7c3bd
SHA1 b73b958e7b8d7c0648dd0f89b58202d75a7388b5
SHA512 5571415d69ab55ca707b6adf22c3f0d27f3f4756b8aa41d51eeb9da25848dfe1d14c6231d415b2744d09c7baebc4ee4c6a542457181417966ddad7fcc97c7968
SSDEEP 384:U6IqLnwBADIjDKf6LiItmXkSVOXFKy+b3p41+b3BnF7H1nIDjYE0W:YanFkepxX9s1Kyyky11H1I
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DrIvERS\SvCHoST.EXe	cbbac547efe9564dd5b0cb6cb9b7c3bd.exe
File opened for modification	C:\Windows\SysWOW64\DrIvERS\SvCHoST.EXe	cbbac547efe9564dd5b0cb6cb9b7c3bd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\update.bak	cbbac547efe9564dd5b0cb6cb9b7c3bd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeRestorePrivilege	3000	cbbac547efe9564dd5b0cb6cb9b7c3bd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3932	3000	cbbac547efe9564dd5b0cb6cb9b7c3bd.exe	99
PID 3000 wrote to memory of 3932	3000	cbbac547efe9564dd5b0cb6cb9b7c3bd.exe	99
PID 3000 wrote to memory of 3932	3000	cbbac547efe9564dd5b0cb6cb9b7c3bd.exe	99

C:\Users\Admin\AppData\Local\Temp\cbbac547efe9564dd5b0cb6cb9b7c3bd.exe
"C:\Users\Admin\AppData\Local\Temp\cbbac547efe9564dd5b0cb6cb9b7c3bd.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c afc9fe2f418b00a0.bat
  2⤵
  PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1396 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:3776

afc9fe2f418b00a0.bat

Path C:\Users\Admin\AppData\Local\Temp\afc9fe2f418b00a0.bat
Size 2KB
SHA256 15fea2afd95ed8e8c3c29da2917400343fac465b772404d1623c564a89675610
MD5 15d225566379e9d257e959f9360d24f8
SHA1 2cb7e47bd6a3e2cf9e8717fc6b8f8ffe6afb33b0
SHA512 49bde9253eac24e9d1489f1555ef2c8dd6922a6906f86b82bac7741886cb77e12d9712f4bd951eccc578242bca78c358b18aa5539506183b0b680e0bab1d94e4
MD5 SHA1 SHA512

Submit Download