50bb137dc5dc91ece4a31d01787c0db3361853f2e7b559ff731c05d102bec0ca

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 11:22

Target

Windows/Temp/adf/anchorDNS_x64.exe
Size

339KB
MD5

7160ac4abb26f0ca4c1b6dfba44f8d36
SHA1

3820ff0d04a233745c79932b77eccfe743a81d34
SHA256

9fdbd76141ec43b6867f091a2dca503edb2a85e4b98a4500611f5fe484109513
SHA512

d52fd1c50865aae16d63a1a7d00d29a2642ddece12b004cfa85e2abcfa25e178d1570aecdafaffefe4889906b81c92f2a2a7ca9032faabe73309f4ba33b70d93
SSDEEP

6144:eC1p/6YfIQrMRU+YqwQR/off22+IJdxKgpCzl2Ac:vb3oK+r/oX22Tb6zl

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

108 cmd.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2492 timeout.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1972 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1972 powershell.exe

pid	process
108	cmd.exe

pid	process
2492	timeout.exe

pid	process
1972	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1972	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

anchorDNS_x64.execmd.execmd.exe

description	pid	process	target process
PID 2072 wrote to memory of 108	2072	anchorDNS_x64.exe	cmd.exe
PID 2072 wrote to memory of 108	2072	anchorDNS_x64.exe	cmd.exe
PID 2072 wrote to memory of 108	2072	anchorDNS_x64.exe	cmd.exe
PID 2072 wrote to memory of 2308	2072	anchorDNS_x64.exe	cmd.exe
PID 2072 wrote to memory of 2308	2072	anchorDNS_x64.exe	cmd.exe
PID 2072 wrote to memory of 2308	2072	anchorDNS_x64.exe	cmd.exe
PID 2308 wrote to memory of 1972	2308	cmd.exe	powershell.exe
PID 2308 wrote to memory of 1972	2308	cmd.exe	powershell.exe
PID 2308 wrote to memory of 1972	2308	cmd.exe	powershell.exe
PID 108 wrote to memory of 2492	108	cmd.exe	timeout.exe
PID 108 wrote to memory of 2492	108	cmd.exe	timeout.exe
PID 108 wrote to memory of 2492	108	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\Windows\Temp\adf\anchorDNS_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Windows\Temp\adf\anchorDNS_x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:2492

C:\Windows\system32\cmd.exe
cmd.exe /C PowerShell "Start-Sleep 3; Remove-Item C:\Users\Admin\AppData\Local\Temp\Windows\Temp\adf\anchorDNS_x64.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2308

memory/1972-4-0x000007FEF5ECE000-0x000007FEF5ECF000-memory.dmp

Filesize
4KB

Download
memory/1972-5-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/1972-6-0x0000000002730000-0x0000000002738000-memory.dmp

Filesize
32KB

Download
memory/1972-7-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/1972-8-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download