98872c915e12259499f1f1a27a6ace74e0b39853bac86f2465ecd9d8140c825f

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 04:09

Target
WinToUSBPortable/App/WinToUSB/bin/CloneLoader.exe
Size 188KB
Sample240530-eq9sasfa28
SHA256 1136be6e509a94a4f24766f13fc90d9dff6d135f8c24d531de4460f70c4e8480
MD5 bacc27660ac899b314b1b3433a7de2c2
SHA1 712cbd5deddca6ba8100bf2dea28bf07aac9e8f9
SHA512 0cd7e9d3fd8d5cc08336d972d37aa6aac3f0f51a3d03c18bb1d3b3d878ddd9edc02dfaa839accdcae14db8d07ec1ecf6a6537e5e008254b15af11be120aedcd9
SSDEEP 3072:v+Epo4QLxbkKXxapJtlpalGJlO/+X2th+TMlxCa8maQ7JcAn1iyie+gm:vFp6xbkK4tl4EJlOG0hflxCvjQVc01ia
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2476	WinToUSB.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2476	WinToUSB.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	2476	WinToUSB.exe
Token: SeBackupPrivilege	2476	WinToUSB.exe
Token: SeRestorePrivilege	2476	WinToUSB.exe
Token: SeTakeOwnershipPrivilege	2476	WinToUSB.exe
Token: SeManageVolumePrivilege	2476	WinToUSB.exe
Token: SeBackupPrivilege	2476	WinToUSB.exe
Token: SeSecurityPrivilege	2476	WinToUSB.exe
Token: SeRestorePrivilege	2476	WinToUSB.exe
Token: SeSecurityPrivilege	2476	WinToUSB.exe
Token: SeTakeOwnershipPrivilege	2476	WinToUSB.exe
Token: SeManageVolumePrivilege	2476	WinToUSB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2476	WinToUSB.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 2476	688	CloneLoader.exe	85
PID 688 wrote to memory of 2476	688	CloneLoader.exe	85

C:\Users\Admin\AppData\Local\Temp\WinToUSBPortable\App\WinToUSB\bin\CloneLoader.exe
"C:\Users\Admin\AppData\Local\Temp\WinToUSBPortable\App\WinToUSB\bin\CloneLoader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:688
- C:\Users\Admin\AppData\Local\Temp\WinToUSBPortable\App\WinToUSB\bin\WinToUSB.exe
  C:\Users\Admin\AppData\Local\Temp\WinToUSBPortable\App\WinToUSB\bin\WinToUSB.exe clone
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2476

WinToUSB.ini

Path C:\Users\Admin\AppData\Local\Temp\WinToUSBPortable\App\WinToUSB\bin\WinToUSB.ini
Size 2KB
SHA256 c24e4d3b3223bfdd7806d080a03b83a1b7afcfc07e1b7b851861f8f013ba076d
MD5 cb8497817cfcd268d6e3280a01a39adb
SHA1 1a1caf6b095f6c6a9e258a1f7f066b0982aeb65a
SHA512 e27f0fd6bfd8165e5c7696adfeccf8713a9c59924154914e0be576c0999a205812379d581c3059635c832ee7619929baea03fbd8911cd1d9a4c21b3d307e0b0c
MD5 SHA1 SHA512

Submit Download

memory/2476-0-0x000000006B8E0000-0x000000006BE29000-memory.dmp

Download