af252d8f2c1166000a47bc52a23ba6dbee07ee4adf4de833f633a33db2aa2152

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 04:20

Target

win.exe
Size

965KB
MD5

2b3ecc21382e825d6fe0812a717717eb
SHA1

f3386531f7726a4f673003bf6cb5806843b76ffb
SHA256

af252d8f2c1166000a47bc52a23ba6dbee07ee4adf4de833f633a33db2aa2152
SHA512

7c1bf7f216861e435e71eaed6f9ff44a8453833c17896e661174b7616a9c25c7da21ad4f8687fe00f39380c7a2bebb854c3d7f47eed14021781ccdfc65dcb7c0
SSDEEP

24576:0GRnx275QAJByPBIA/7oWw7XNyTvvvsjPhWm+2sGb6aYU8XFUiUBJRR7VFrQSgds:0GRna2EByPBIA/7oWw7XNyTvvUbhl+2j

Score

5^/10

Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4336	sc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 1520	3564	win.exe	91
PID 3564 wrote to memory of 1520	3564	win.exe	91
PID 1520 wrote to memory of 4336	1520	cmd.exe	93
PID 1520 wrote to memory of 4336	1520	cmd.exe	93
PID 3564 wrote to memory of 2404	3564	win.exe	94
PID 3564 wrote to memory of 2404	3564	win.exe	94
PID 3564 wrote to memory of 2404	3564	win.exe	94
PID 3564 wrote to memory of 2404	3564	win.exe	94
PID 3564 wrote to memory of 2404	3564	win.exe	94
PID 3564 wrote to memory of 2404	3564	win.exe	94
PID 3564 wrote to memory of 2404	3564	win.exe	94
PID 3564 wrote to memory of 2404	3564	win.exe	94
PID 3564 wrote to memory of 2404	3564	win.exe	94
PID 3564 wrote to memory of 2404	3564	win.exe	94
PID 3564 wrote to memory of 2404	3564	win.exe	94

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2404

memory/2404-0-0x0000000180000000-0x00000001800E8000-memory.dmp

Filesize
928KB

Download
memory/2404-1-0x000002AB7D470000-0x000002AB7D471000-memory.dmp

Filesize
4KB

Download
memory/2404-2-0x000002AB7D450000-0x000002AB7D451000-memory.dmp

Filesize
4KB

Download
memory/2404-3-0x0000000180000000-0x00000001800E8000-memory.dmp

Filesize
928KB

Download
memory/2404-5-0x0000000180000000-0x00000001800E8000-memory.dmp

Filesize
928KB

Download
memory/2404-8-0x0000000180000000-0x00000001800E8000-memory.dmp

Filesize
928KB

Download