5856e56549d4e396e03af130d9907d053ccf762207f1df0fb275b2eea7f6c573

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 16:26

Target

cbe08a33864bf3b46a9b03664d57866b.exe
Size

20KB
MD5

cbe08a33864bf3b46a9b03664d57866b
SHA1

6282571b53218fdc7ce4f5902db6773f7f8c1f93
SHA256

5856e56549d4e396e03af130d9907d053ccf762207f1df0fb275b2eea7f6c573
SHA512

55cece58081b650837de5795ffde6771a3bdeac181f32ea9de3fb142a85edfa506d292dc3dcb70ae07f64bb371da8608068200880143c36a5dc09972b78cfd47
SSDEEP

384:X8JWL14Tpc9WtHMgUrGOIi2GeAIrpgmgSfkhNnYiPmyRS3tO/:uoGTprtHMgEVl2IIrqmg3n9ZRS3E

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2700	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\secmgnt.dll	cbe08a33864bf3b46a9b03664d57866b.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2012	cbe08a33864bf3b46a9b03664d57866b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	cbe08a33864bf3b46a9b03664d57866b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2700	2012	cbe08a33864bf3b46a9b03664d57866b.exe	27
PID 2012 wrote to memory of 2700	2012	cbe08a33864bf3b46a9b03664d57866b.exe	27
PID 2012 wrote to memory of 2700	2012	cbe08a33864bf3b46a9b03664d57866b.exe	27
PID 2012 wrote to memory of 2700	2012	cbe08a33864bf3b46a9b03664d57866b.exe	27

C:\Users\Admin\AppData\Local\Temp\cbe08a33864bf3b46a9b03664d57866b.exe
"C:\Users\Admin\AppData\Local\Temp\cbe08a33864bf3b46a9b03664d57866b.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\delself0.bat
  2⤵
  - Deletes itself
  PID:2700

C:\Users\Admin\AppData\Local\Temp\delself0.bat

Filesize
197B

MD5
4067262f24002d8a3dac3e85eea835b3

SHA1
e9d22839db94383da43eed2c90d4a2b42302ae4d

SHA256
a198068401d1d17113c185eb4ce28ed4f5418eaf2f1aab4ccc19315851725a80

SHA512
0f7f412022041adabf2f01955cf6d04dd419a70a1695f329b1e72c88c00b85c3417c4cf3b449a2fd7cb7c38d1f8d6a399454033e7e77c5e885c09e1f972cb5e1

Download Submit
memory/2012-1-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2012-9-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download