50bb137dc5dc91ece4a31d01787c0db3361853f2e7b559ff731c05d102bec0ca

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 11:22

Target

Windows/Temp/adf/anchorDNS_x64.exe
Size

339KB
MD5

7160ac4abb26f0ca4c1b6dfba44f8d36
SHA1

3820ff0d04a233745c79932b77eccfe743a81d34
SHA256

9fdbd76141ec43b6867f091a2dca503edb2a85e4b98a4500611f5fe484109513
SHA512

d52fd1c50865aae16d63a1a7d00d29a2642ddece12b004cfa85e2abcfa25e178d1570aecdafaffefe4889906b81c92f2a2a7ca9032faabe73309f4ba33b70d93
SSDEEP

6144:eC1p/6YfIQrMRU+YqwQR/off22+IJdxKgpCzl2Ac:vb3oK+r/oX22Tb6zl

Score

7^/10

Deletes itself 1 IoCs

pid	Process
108	cmd.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2492	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1972	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 108	2072	anchorDNS_x64.exe	28
PID 2072 wrote to memory of 108	2072	anchorDNS_x64.exe	28
PID 2072 wrote to memory of 108	2072	anchorDNS_x64.exe	28
PID 2072 wrote to memory of 2308	2072	anchorDNS_x64.exe	29
PID 2072 wrote to memory of 2308	2072	anchorDNS_x64.exe	29
PID 2072 wrote to memory of 2308	2072	anchorDNS_x64.exe	29
PID 2308 wrote to memory of 1972	2308	cmd.exe	32
PID 2308 wrote to memory of 1972	2308	cmd.exe	32
PID 2308 wrote to memory of 1972	2308	cmd.exe	32
PID 108 wrote to memory of 2492	108	cmd.exe	33
PID 108 wrote to memory of 2492	108	cmd.exe	33
PID 108 wrote to memory of 2492	108	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\Windows\Temp\adf\anchorDNS_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Windows\Temp\adf\anchorDNS_x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\system32\cmd.exe
  cmd.exe /c timeout 3 && del C:\Users\Admin\AppData\Local\Temp\Windows\Temp\adf\anchorDNS_x64.exe
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:108
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2492
- C:\Windows\system32\cmd.exe
  cmd.exe /C PowerShell "Start-Sleep 3; Remove-Item C:\Users\Admin\AppData\Local\Temp\Windows\Temp\adf\anchorDNS_x64.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell "Start-Sleep 3; Remove-Item C:\Users\Admin\AppData\Local\Temp\Windows\Temp\adf\anchorDNS_x64.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1972

memory/1972-4-0x000007FEF5ECE000-0x000007FEF5ECF000-memory.dmp

Filesize
4KB

Download
memory/1972-5-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/1972-6-0x0000000002730000-0x0000000002738000-memory.dmp

Filesize
32KB

Download
memory/1972-7-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/1972-8-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download