Analysis
-
max time kernel
12s -
max time network
15s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 05:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dropper.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
dropper.exe
Resource
win11-20240802-en
windows11-21h2-x64
2 signatures
150 seconds
General
-
Target
dropper.exe
-
Size
33.5MB
-
MD5
015284acad2143df3f35359347c2daa9
-
SHA1
5b0d09e041f1ca758cda3147996d9bf18016494a
-
SHA256
213d08e80912d16f3d53c57b498e8fc0f46ffdd0aeb36119a2827e1631dc0907
-
SHA512
0088a2c58860fcd643b7a8a8432b1378668dd5b04979a4026bda314b863903c07437cbd6cb8eea44c6da630ca7b61b687dde57e11b373d59ad711354126d3b0e
-
SSDEEP
786432:lkghU6KScDz/3G5qz0dwUOA9ZCVgQKwWCIPwUT49Zf3/A:agmHDb25qz0dQAUgGXIPwbZnA
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1060 wmic.exe Token: SeSecurityPrivilege 1060 wmic.exe Token: SeTakeOwnershipPrivilege 1060 wmic.exe Token: SeLoadDriverPrivilege 1060 wmic.exe Token: SeSystemProfilePrivilege 1060 wmic.exe Token: SeSystemtimePrivilege 1060 wmic.exe Token: SeProfSingleProcessPrivilege 1060 wmic.exe Token: SeIncBasePriorityPrivilege 1060 wmic.exe Token: SeCreatePagefilePrivilege 1060 wmic.exe Token: SeBackupPrivilege 1060 wmic.exe Token: SeRestorePrivilege 1060 wmic.exe Token: SeShutdownPrivilege 1060 wmic.exe Token: SeDebugPrivilege 1060 wmic.exe Token: SeSystemEnvironmentPrivilege 1060 wmic.exe Token: SeRemoteShutdownPrivilege 1060 wmic.exe Token: SeUndockPrivilege 1060 wmic.exe Token: SeManageVolumePrivilege 1060 wmic.exe Token: 33 1060 wmic.exe Token: 34 1060 wmic.exe Token: 35 1060 wmic.exe Token: 36 1060 wmic.exe Token: SeIncreaseQuotaPrivilege 1060 wmic.exe Token: SeSecurityPrivilege 1060 wmic.exe Token: SeTakeOwnershipPrivilege 1060 wmic.exe Token: SeLoadDriverPrivilege 1060 wmic.exe Token: SeSystemProfilePrivilege 1060 wmic.exe Token: SeSystemtimePrivilege 1060 wmic.exe Token: SeProfSingleProcessPrivilege 1060 wmic.exe Token: SeIncBasePriorityPrivilege 1060 wmic.exe Token: SeCreatePagefilePrivilege 1060 wmic.exe Token: SeBackupPrivilege 1060 wmic.exe Token: SeRestorePrivilege 1060 wmic.exe Token: SeShutdownPrivilege 1060 wmic.exe Token: SeDebugPrivilege 1060 wmic.exe Token: SeSystemEnvironmentPrivilege 1060 wmic.exe Token: SeRemoteShutdownPrivilege 1060 wmic.exe Token: SeUndockPrivilege 1060 wmic.exe Token: SeManageVolumePrivilege 1060 wmic.exe Token: 33 1060 wmic.exe Token: 34 1060 wmic.exe Token: 35 1060 wmic.exe Token: 36 1060 wmic.exe Token: SeIncreaseQuotaPrivilege 4904 wmic.exe Token: SeSecurityPrivilege 4904 wmic.exe Token: SeTakeOwnershipPrivilege 4904 wmic.exe Token: SeLoadDriverPrivilege 4904 wmic.exe Token: SeSystemProfilePrivilege 4904 wmic.exe Token: SeSystemtimePrivilege 4904 wmic.exe Token: SeProfSingleProcessPrivilege 4904 wmic.exe Token: SeIncBasePriorityPrivilege 4904 wmic.exe Token: SeCreatePagefilePrivilege 4904 wmic.exe Token: SeBackupPrivilege 4904 wmic.exe Token: SeRestorePrivilege 4904 wmic.exe Token: SeShutdownPrivilege 4904 wmic.exe Token: SeDebugPrivilege 4904 wmic.exe Token: SeSystemEnvironmentPrivilege 4904 wmic.exe Token: SeRemoteShutdownPrivilege 4904 wmic.exe Token: SeUndockPrivilege 4904 wmic.exe Token: SeManageVolumePrivilege 4904 wmic.exe Token: 33 4904 wmic.exe Token: 34 4904 wmic.exe Token: 35 4904 wmic.exe Token: 36 4904 wmic.exe Token: SeIncreaseQuotaPrivilege 4904 wmic.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4876 wrote to memory of 1060 4876 dropper.exe 84 PID 4876 wrote to memory of 1060 4876 dropper.exe 84 PID 4876 wrote to memory of 4904 4876 dropper.exe 87 PID 4876 wrote to memory of 4904 4876 dropper.exe 87 PID 1608 wrote to memory of 4828 1608 cmd.exe 99 PID 1608 wrote to memory of 4828 1608 cmd.exe 99 PID 4828 wrote to memory of 740 4828 dropper.exe 100 PID 4828 wrote to memory of 740 4828 dropper.exe 100 PID 4828 wrote to memory of 2304 4828 dropper.exe 102 PID 4828 wrote to memory of 2304 4828 dropper.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\dropper.exe"C:\Users\Admin\AppData\Local\Temp\dropper.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" diskdrive get Model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" diskdrive get Model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4904
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4356
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\dropper.exedropper.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" diskdrive get Model3⤵PID:740
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" diskdrive get Model3⤵PID:2304
-
-