a1e9d2a0a36f1cb5b3fd09a3e07335f9987549fca015428369043031e2cc67cc

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 16:13

Target

Unpacked/pppwn/PPPwn GUI 1.5.exe
Size

8.5MB
MD5

62a1d287a17007f98f776e9581de43f0
SHA1

3cd8aa22cf404c2b985c779e0653bdf6074cff3d
SHA256

de1a2c5f67fef973d84d32e8d469d5ac7f1f0aa071e35260ff0c959705b13b29
SHA512

2d4fa3f61f420912cf5a6531fac05414f3e3de7bc02e02aaddfe60314ccf3fa8f5d250681238643b02d9feb853e06a686faebfc68771932612420980e385fe84
SSDEEP

196608:UbvpiZgqLDs2PxBRKb5ZWDl98canLcWnPOA+j8OGE3BbbRYl:48ZZHPx3gZpVdGR9xJRYl

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

pppwn_.exe

pid process

1524 pppwn_.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2744 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 2744 taskkill.exe

pid	process
1524	pppwn_.exe

pid	process
2744	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	2744	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

PPPwn GUI 1.5.execmd.exepppwn_.exe

description	pid	process	target process
PID 2860 wrote to memory of 2676	2860	PPPwn GUI 1.5.exe	cmd.exe
PID 2860 wrote to memory of 2676	2860	PPPwn GUI 1.5.exe	cmd.exe
PID 2860 wrote to memory of 2676	2860	PPPwn GUI 1.5.exe	cmd.exe
PID 2860 wrote to memory of 2676	2860	PPPwn GUI 1.5.exe	cmd.exe
PID 2676 wrote to memory of 2744	2676	cmd.exe	taskkill.exe
PID 2676 wrote to memory of 2744	2676	cmd.exe	taskkill.exe
PID 2676 wrote to memory of 2744	2676	cmd.exe	taskkill.exe
PID 2676 wrote to memory of 2744	2676	cmd.exe	taskkill.exe
PID 2860 wrote to memory of 1944	2860	PPPwn GUI 1.5.exe	pppwn_.exe
PID 2860 wrote to memory of 1944	2860	PPPwn GUI 1.5.exe	pppwn_.exe
PID 2860 wrote to memory of 1944	2860	PPPwn GUI 1.5.exe	pppwn_.exe
PID 2860 wrote to memory of 1944	2860	PPPwn GUI 1.5.exe	pppwn_.exe
PID 1944 wrote to memory of 1524	1944	pppwn_.exe	pppwn_.exe
PID 1944 wrote to memory of 1524	1944	pppwn_.exe	pppwn_.exe
PID 1944 wrote to memory of 1524	1944	pppwn_.exe	pppwn_.exe
PID 1944 wrote to memory of 1524	1944	pppwn_.exe	pppwn_.exe

C:\Users\Admin\AppData\Local\Temp\Unpacked\pppwn\PPPwn GUI 1.5.exe
"C:\Users\Admin\AppData\Local\Temp\Unpacked\pppwn\PPPwn GUI 1.5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /IM pppwn_.exe /f
2⤵
- Suspicious use of WriteProcessMemory
PID:2676

C:\Users\Admin\AppData\Local\Temp\Unpacked\pppwn\exploit\pppwn_.exe
"exploit\pppwn_.exe" --interface="" --fw=1100 --stage1=exploit\stage1\stage1_1100.bin --stage2=exploit\stage2\stage2_1100.bin
2⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Users\Admin\AppData\Local\Temp\Unpacked\pppwn\exploit\pppwn_.exe
"exploit\pppwn_.exe" --interface="" --fw=1100 --stage1=exploit\stage1\stage1_1100.bin --stage2=exploit\stage2\stage2_1100.bin
3⤵
- Loads dropped DLL
PID:1524

C:\Users\Admin\AppData\Local\Temp\_MEI19442\python311.dll
Filesize
4.7MB

MD5
68193b0ed6bb05e7bf70e380852a4e58

SHA1
842c0346cfbc140988f00c91b575f9b81de94b26

SHA256
d08c8e21a93e60c13ebe30a805f0276e0c8950e4a8af76e6271f1e7264440110

SHA512
f15bbbad656b67e3ece46c9fd624e360471c96cadc636b098b85eb7b37d3d0b06ec774dc843262bcdb3524f4d6bd2659965219dc35c156cd7f60e2f48388b441

Download Submit
memory/2860-0-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

Filesize
4KB

Download
memory/2860-1-0x00000000010D0000-0x0000000001952000-memory.dmp

Filesize
8.5MB

Download
memory/2860-2-0x0000000005110000-0x0000000005604000-memory.dmp

Filesize
5.0MB

Download
memory/2860-3-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download
memory/2860-4-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download
memory/2860-5-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download