Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
19-09-2024 05:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dropper.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
dropper.exe
Resource
win11-20240802-en
windows11-21h2-x64
2 signatures
150 seconds
General
-
Target
dropper.exe
-
Size
33.5MB
-
MD5
015284acad2143df3f35359347c2daa9
-
SHA1
5b0d09e041f1ca758cda3147996d9bf18016494a
-
SHA256
213d08e80912d16f3d53c57b498e8fc0f46ffdd0aeb36119a2827e1631dc0907
-
SHA512
0088a2c58860fcd643b7a8a8432b1378668dd5b04979a4026bda314b863903c07437cbd6cb8eea44c6da630ca7b61b687dde57e11b373d59ad711354126d3b0e
-
SSDEEP
786432:lkghU6KScDz/3G5qz0dwUOA9ZCVgQKwWCIPwUT49Zf3/A:agmHDb25qz0dQAUgGXIPwbZnA
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2192 wmic.exe Token: SeSecurityPrivilege 2192 wmic.exe Token: SeTakeOwnershipPrivilege 2192 wmic.exe Token: SeLoadDriverPrivilege 2192 wmic.exe Token: SeSystemProfilePrivilege 2192 wmic.exe Token: SeSystemtimePrivilege 2192 wmic.exe Token: SeProfSingleProcessPrivilege 2192 wmic.exe Token: SeIncBasePriorityPrivilege 2192 wmic.exe Token: SeCreatePagefilePrivilege 2192 wmic.exe Token: SeBackupPrivilege 2192 wmic.exe Token: SeRestorePrivilege 2192 wmic.exe Token: SeShutdownPrivilege 2192 wmic.exe Token: SeDebugPrivilege 2192 wmic.exe Token: SeSystemEnvironmentPrivilege 2192 wmic.exe Token: SeRemoteShutdownPrivilege 2192 wmic.exe Token: SeUndockPrivilege 2192 wmic.exe Token: SeManageVolumePrivilege 2192 wmic.exe Token: 33 2192 wmic.exe Token: 34 2192 wmic.exe Token: 35 2192 wmic.exe Token: 36 2192 wmic.exe Token: SeIncreaseQuotaPrivilege 2192 wmic.exe Token: SeSecurityPrivilege 2192 wmic.exe Token: SeTakeOwnershipPrivilege 2192 wmic.exe Token: SeLoadDriverPrivilege 2192 wmic.exe Token: SeSystemProfilePrivilege 2192 wmic.exe Token: SeSystemtimePrivilege 2192 wmic.exe Token: SeProfSingleProcessPrivilege 2192 wmic.exe Token: SeIncBasePriorityPrivilege 2192 wmic.exe Token: SeCreatePagefilePrivilege 2192 wmic.exe Token: SeBackupPrivilege 2192 wmic.exe Token: SeRestorePrivilege 2192 wmic.exe Token: SeShutdownPrivilege 2192 wmic.exe Token: SeDebugPrivilege 2192 wmic.exe Token: SeSystemEnvironmentPrivilege 2192 wmic.exe Token: SeRemoteShutdownPrivilege 2192 wmic.exe Token: SeUndockPrivilege 2192 wmic.exe Token: SeManageVolumePrivilege 2192 wmic.exe Token: 33 2192 wmic.exe Token: 34 2192 wmic.exe Token: 35 2192 wmic.exe Token: 36 2192 wmic.exe Token: SeIncreaseQuotaPrivilege 4708 wmic.exe Token: SeSecurityPrivilege 4708 wmic.exe Token: SeTakeOwnershipPrivilege 4708 wmic.exe Token: SeLoadDriverPrivilege 4708 wmic.exe Token: SeSystemProfilePrivilege 4708 wmic.exe Token: SeSystemtimePrivilege 4708 wmic.exe Token: SeProfSingleProcessPrivilege 4708 wmic.exe Token: SeIncBasePriorityPrivilege 4708 wmic.exe Token: SeCreatePagefilePrivilege 4708 wmic.exe Token: SeBackupPrivilege 4708 wmic.exe Token: SeRestorePrivilege 4708 wmic.exe Token: SeShutdownPrivilege 4708 wmic.exe Token: SeDebugPrivilege 4708 wmic.exe Token: SeSystemEnvironmentPrivilege 4708 wmic.exe Token: SeRemoteShutdownPrivilege 4708 wmic.exe Token: SeUndockPrivilege 4708 wmic.exe Token: SeManageVolumePrivilege 4708 wmic.exe Token: 33 4708 wmic.exe Token: 34 4708 wmic.exe Token: 35 4708 wmic.exe Token: 36 4708 wmic.exe Token: SeIncreaseQuotaPrivilege 4708 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1032 wrote to memory of 2192 1032 dropper.exe 79 PID 1032 wrote to memory of 2192 1032 dropper.exe 79 PID 1032 wrote to memory of 4708 1032 dropper.exe 82 PID 1032 wrote to memory of 4708 1032 dropper.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\dropper.exe"C:\Users\Admin\AppData\Local\Temp\dropper.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" diskdrive get Model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2192
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" diskdrive get Model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4708
-