98872c915e12259499f1f1a27a6ace74e0b39853bac86f2465ecd9d8140c825f

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 04:09

Target
WinToUSBPortable/App/WinToUSB/bin/CloneLoader.exe
Size 188KB
Sample240530-eq9sasfa28
SHA256 1136be6e509a94a4f24766f13fc90d9dff6d135f8c24d531de4460f70c4e8480
MD5 bacc27660ac899b314b1b3433a7de2c2
SHA1 712cbd5deddca6ba8100bf2dea28bf07aac9e8f9
SHA512 0cd7e9d3fd8d5cc08336d972d37aa6aac3f0f51a3d03c18bb1d3b3d878ddd9edc02dfaa839accdcae14db8d07ec1ecf6a6537e5e008254b15af11be120aedcd9
SSDEEP 3072:v+Epo4QLxbkKXxapJtlpalGJlO/+X2th+TMlxCa8maQ7JcAn1iyie+gm:vFp6xbkK4tl4EJlOG0hflxCvjQVc01ia
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1992	WinToUSB.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1992	WinToUSB.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	1992	WinToUSB.exe
Token: SeBackupPrivilege	1992	WinToUSB.exe
Token: SeRestorePrivilege	1992	WinToUSB.exe
Token: SeTakeOwnershipPrivilege	1992	WinToUSB.exe
Token: SeManageVolumePrivilege	1992	WinToUSB.exe
Token: SeBackupPrivilege	1992	WinToUSB.exe
Token: SeSecurityPrivilege	1992	WinToUSB.exe
Token: SeRestorePrivilege	1992	WinToUSB.exe
Token: SeSecurityPrivilege	1992	WinToUSB.exe
Token: SeTakeOwnershipPrivilege	1992	WinToUSB.exe
Token: SeManageVolumePrivilege	1992	WinToUSB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1992	WinToUSB.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1992	2228	CloneLoader.exe	28
PID 2228 wrote to memory of 1992	2228	CloneLoader.exe	28
PID 2228 wrote to memory of 1992	2228	CloneLoader.exe	28

C:\Users\Admin\AppData\Local\Temp\WinToUSBPortable\App\WinToUSB\bin\CloneLoader.exe
"C:\Users\Admin\AppData\Local\Temp\WinToUSBPortable\App\WinToUSB\bin\CloneLoader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\WinToUSBPortable\App\WinToUSB\bin\WinToUSB.exe
  C:\Users\Admin\AppData\Local\Temp\WinToUSBPortable\App\WinToUSB\bin\WinToUSB.exe clone
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1992

WinToUSB.ini

Path C:\Users\Admin\AppData\Local\Temp\WinToUSBPortable\App\WinToUSB\bin\WinToUSB.ini
Size 2KB
SHA256 7ff87737c37e9b4c211bb262e2eab45496016be0d2e7abb6176532159bfdb46b
MD5 153455312eae93ba80e5b4dad2d4f82f
SHA1 9e32e38e1d9489190c6f7a3b92ea0af8d1a1afec
SHA512 5e2e474b15ae4be565fbf66230c90a63b075db5351c53b19dd273a738b2444dcf76d1a9766465b8b7ab27c0118950f29a1baeb08e1afffba77559329365289ad
MD5 SHA1 SHA512

Submit Download

memory/1992-0-0x0000000074150000-0x0000000074699000-memory.dmp

Download