81c18c346ad57ff5c4dc07fe51b0e9411704cb9df362aefd6d6275f6f9660d47

Analysis

max time kernel
140s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 18:09

Target

bUPt.exe
Size

32KB
MD5

b0f3ca4450a2f669b927ae1517dac1e7
SHA1

7390d9dcd74c4c40f536c8f490f0ba1580523c77
SHA256

81c18c346ad57ff5c4dc07fe51b0e9411704cb9df362aefd6d6275f6f9660d47
SHA512

de72099a2b301b683534a163a4b3c918a035d1f2f2e25c714e5133b3ad3a62b201b14a200b3459cfa19ae339ec9035eaedd26be27fd70fe1db5b11e84b7ca936
SSDEEP

384:O0bUe5XB4e0XvObfixBr/QdWTStTUFQqzFqObbm:fT9BumTifrYfkbm

Score

1^/10

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

bUPt.exe

description	pid	process
Token: SeDebugPrivilege	1100	bUPt.exe
Token: 33	1100	bUPt.exe
Token: SeIncBasePriorityPrivilege	1100	bUPt.exe
Token: 33	1100	bUPt.exe
Token: SeIncBasePriorityPrivilege	1100	bUPt.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bUPt.exe

description	pid	process	target process
PID 1100 wrote to memory of 2092	1100	bUPt.exe	cmd.exe
PID 1100 wrote to memory of 2092	1100	bUPt.exe	cmd.exe
PID 1100 wrote to memory of 2092	1100	bUPt.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\bUPt.exe"
2⤵
PID:2092

memory/1100-0-0x0000000074B32000-0x0000000074B33000-memory.dmp

Filesize
4KB

Download
memory/1100-1-0x0000000074B30000-0x00000000750E1000-memory.dmp

Filesize
5.7MB

Download
memory/1100-2-0x0000000074B30000-0x00000000750E1000-memory.dmp

Filesize
5.7MB

Download
memory/1100-3-0x0000000074B30000-0x00000000750E1000-memory.dmp

Filesize
5.7MB

Download
memory/1100-4-0x0000000074B32000-0x0000000074B33000-memory.dmp

Filesize
4KB

Download
memory/1100-6-0x0000000074B30000-0x00000000750E1000-memory.dmp

Filesize
5.7MB

Download