25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 04:31

Target

25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe
Size

1.5MB
MD5

02c4214879f5042254031f0185c69b51
SHA1

7ed0a14e94dc60d94be873f9fb3d01716b685017
SHA256

25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4
SHA512

198846d4cd0f753b80ed19774c503685e72f4e68ec6f85edcc1f2c592c4c8177f730c551b60d0febfd46e51a49fe6ae45f03c57e05167f54e73f5c703362be7f
SSDEEP

24576:FKnTIDPyaRQ35lgY+084Zy6W4WYtVm/Bd8R3I9aRtZG1MO4EasFmY3i2YliN:ti39+084E6W4W8Vm/BQ49aXZmMAjSw

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2504	sg.tmp

Loads dropped DLL 1 IoCs

pid	Process
2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeBackupPrivilege	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe
Token: SeRestorePrivilege	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe
Token: 33	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe
Token: SeIncBasePriorityPrivilege	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe
Token: 33	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe
Token: SeIncBasePriorityPrivilege	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe
Token: 33	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe
Token: SeIncBasePriorityPrivilege	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe
Token: SeRestorePrivilege	2504	sg.tmp
Token: 35	2504	sg.tmp
Token: SeSecurityPrivilege	2504	sg.tmp
Token: SeSecurityPrivilege	2504	sg.tmp
Token: SeDebugPrivilege	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2168	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe	28
PID 2380 wrote to memory of 2168	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe	28
PID 2380 wrote to memory of 2168	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe	28
PID 2380 wrote to memory of 2168	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe	28
PID 2380 wrote to memory of 2504	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe	30
PID 2380 wrote to memory of 2504	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe	30
PID 2380 wrote to memory of 2504	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe	30
PID 2380 wrote to memory of 2504	2380	25f94ac172cf0629240d5e9d6c2a44c3f66f56f10fdb0446bccc489c44d3aeb4.exe	30

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\~4498781735595540377~\sg.tmp

Filesize
715KB

MD5
7c4718943bd3f66ebdb47ccca72c7b1e

SHA1
f9edfaa7adb8fa528b2e61b2b251f18da10a6969

SHA256
4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc

SHA512
e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516

Download Submit
memory/2380-11-0x00000000021F0000-0x00000000022F0000-memory.dmp

Filesize
1024KB

Download