Analysis
-
max time kernel
140s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 02:41
Behavioral task
behavioral1
Sample
rz237h0exc.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
rz237h0exc.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
rz237h0exc.exe
-
Size
32KB
-
MD5
82f906ef34a36af6a462f5b89413db3d
-
SHA1
844fb217cfd229162dd965ff1a61d752f20d2fab
-
SHA256
8747cdc857e1fc0b9712404ae4da1bb571677d867cb271e29ca1a6a9734d049f
-
SHA512
baf015f103539f7ac2108be565216b9cdf5514f2a57194a8a314efee5be33a0c867fbcccfb100ea0af96331e691795056d82f6bb8196e463a8c44b3e4c334c8f
-
SSDEEP
384:+0bUe5XB4e0X7OVcsw0Q0mS03LWTmtTUFQqzFyObbk:vT9BuC6555b4bk
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
rz237h0exc.exedescription pid process Token: SeDebugPrivilege 3252 rz237h0exc.exe Token: 33 3252 rz237h0exc.exe Token: SeIncBasePriorityPrivilege 3252 rz237h0exc.exe Token: 33 3252 rz237h0exc.exe Token: SeIncBasePriorityPrivilege 3252 rz237h0exc.exe Token: 33 3252 rz237h0exc.exe Token: SeIncBasePriorityPrivilege 3252 rz237h0exc.exe Token: 33 3252 rz237h0exc.exe Token: SeIncBasePriorityPrivilege 3252 rz237h0exc.exe Token: 33 3252 rz237h0exc.exe Token: SeIncBasePriorityPrivilege 3252 rz237h0exc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rz237h0exc.exedescription pid process target process PID 3252 wrote to memory of 1432 3252 rz237h0exc.exe cmd.exe PID 3252 wrote to memory of 1432 3252 rz237h0exc.exe cmd.exe PID 3252 wrote to memory of 1432 3252 rz237h0exc.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rz237h0exc.exe"C:\Users\Admin\AppData\Local\Temp\rz237h0exc.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\rz237h0exc.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3252-0-0x0000000074ED2000-0x0000000074ED3000-memory.dmpFilesize
4KB
-
memory/3252-1-0x0000000074ED0000-0x0000000075481000-memory.dmpFilesize
5.7MB
-
memory/3252-2-0x0000000074ED0000-0x0000000075481000-memory.dmpFilesize
5.7MB
-
memory/3252-3-0x0000000074ED2000-0x0000000074ED3000-memory.dmpFilesize
4KB
-
memory/3252-4-0x0000000074ED0000-0x0000000075481000-memory.dmpFilesize
5.7MB
-
memory/3252-5-0x0000000074ED0000-0x0000000075481000-memory.dmpFilesize
5.7MB
-
memory/3252-7-0x0000000074ED0000-0x0000000075481000-memory.dmpFilesize
5.7MB