2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf

Analysis

max time kernel
142s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 10:05

Target

2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf.exe
Size

114KB
MD5

382fc1a3c5225fceb672eea13f572a38
SHA1

d9a3596af0463797df4ff25b7999184946e3bfa2
SHA256

2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf
SHA512

0fa729f6834d475f787634cc69592633c32a0368c63abac5f702bdd8fd838ad9ceb50941448518a3bf1da0ab45bf6b0dac42d99168d51916591277db19dedacd
SSDEEP

1536:bV3+WmNcWDurilmw9BgjKu1sPPxaS4jqY:bV3+WmjDxlPwV16PkS4jqY

Score

8^/10

Drops file in Drivers directory 3 IoCs

Processes:

2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\zddr	2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf.exe
File opened for modification	C:\Windows\system32\Drivers\zddr	2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf.exe
File created	C:\Windows\system32\Drivers\zddr.sys	2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf.exe

Suspicious behavior: LoadsDriver 5 IoCs

Processes:

pid process

672
672
672
672
672

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf.exe

description	pid	process
Token: 0	1848	2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf.exe
Token: SeBackupPrivilege	1848	2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf.exe
Token: SeLoadDriverPrivilege	1848	2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:384