Analysis
-
max time kernel
21s -
max time network
18s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 07:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dropper.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
dropper.exe
-
Size
33.5MB
-
MD5
18837db65213bcdc5992323b32e59156
-
SHA1
130988a83b2eaf158b4f1a941bfa32a68ab924f3
-
SHA256
0ccec2a2460cf292b9b23fc7eabfc3799bd5bf5fcb43e42a46116cc4a755a38c
-
SHA512
8ce7c0240ae07ede13b809dae734baa36943a0f4fb3bd398bf3548204a82e8aa393879db23a96fcf2a1c71249ed843d59f04db2df7fe3ef68e665c08b047ed0e
-
SSDEEP
786432:lkghy9KScDz/3G5qz0dwUOA9ZCVgQKwWCIPwUT49Zf3/p:agcIDb25qz0dQAUgGXIPwbZnp
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3564 wmic.exe Token: SeSecurityPrivilege 3564 wmic.exe Token: SeTakeOwnershipPrivilege 3564 wmic.exe Token: SeLoadDriverPrivilege 3564 wmic.exe Token: SeSystemProfilePrivilege 3564 wmic.exe Token: SeSystemtimePrivilege 3564 wmic.exe Token: SeProfSingleProcessPrivilege 3564 wmic.exe Token: SeIncBasePriorityPrivilege 3564 wmic.exe Token: SeCreatePagefilePrivilege 3564 wmic.exe Token: SeBackupPrivilege 3564 wmic.exe Token: SeRestorePrivilege 3564 wmic.exe Token: SeShutdownPrivilege 3564 wmic.exe Token: SeDebugPrivilege 3564 wmic.exe Token: SeSystemEnvironmentPrivilege 3564 wmic.exe Token: SeRemoteShutdownPrivilege 3564 wmic.exe Token: SeUndockPrivilege 3564 wmic.exe Token: SeManageVolumePrivilege 3564 wmic.exe Token: 33 3564 wmic.exe Token: 34 3564 wmic.exe Token: 35 3564 wmic.exe Token: 36 3564 wmic.exe Token: SeIncreaseQuotaPrivilege 3564 wmic.exe Token: SeSecurityPrivilege 3564 wmic.exe Token: SeTakeOwnershipPrivilege 3564 wmic.exe Token: SeLoadDriverPrivilege 3564 wmic.exe Token: SeSystemProfilePrivilege 3564 wmic.exe Token: SeSystemtimePrivilege 3564 wmic.exe Token: SeProfSingleProcessPrivilege 3564 wmic.exe Token: SeIncBasePriorityPrivilege 3564 wmic.exe Token: SeCreatePagefilePrivilege 3564 wmic.exe Token: SeBackupPrivilege 3564 wmic.exe Token: SeRestorePrivilege 3564 wmic.exe Token: SeShutdownPrivilege 3564 wmic.exe Token: SeDebugPrivilege 3564 wmic.exe Token: SeSystemEnvironmentPrivilege 3564 wmic.exe Token: SeRemoteShutdownPrivilege 3564 wmic.exe Token: SeUndockPrivilege 3564 wmic.exe Token: SeManageVolumePrivilege 3564 wmic.exe Token: 33 3564 wmic.exe Token: 34 3564 wmic.exe Token: 35 3564 wmic.exe Token: 36 3564 wmic.exe Token: SeIncreaseQuotaPrivilege 3644 wmic.exe Token: SeSecurityPrivilege 3644 wmic.exe Token: SeTakeOwnershipPrivilege 3644 wmic.exe Token: SeLoadDriverPrivilege 3644 wmic.exe Token: SeSystemProfilePrivilege 3644 wmic.exe Token: SeSystemtimePrivilege 3644 wmic.exe Token: SeProfSingleProcessPrivilege 3644 wmic.exe Token: SeIncBasePriorityPrivilege 3644 wmic.exe Token: SeCreatePagefilePrivilege 3644 wmic.exe Token: SeBackupPrivilege 3644 wmic.exe Token: SeRestorePrivilege 3644 wmic.exe Token: SeShutdownPrivilege 3644 wmic.exe Token: SeDebugPrivilege 3644 wmic.exe Token: SeSystemEnvironmentPrivilege 3644 wmic.exe Token: SeRemoteShutdownPrivilege 3644 wmic.exe Token: SeUndockPrivilege 3644 wmic.exe Token: SeManageVolumePrivilege 3644 wmic.exe Token: 33 3644 wmic.exe Token: 34 3644 wmic.exe Token: 35 3644 wmic.exe Token: 36 3644 wmic.exe Token: SeIncreaseQuotaPrivilege 3644 wmic.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3316 wrote to memory of 3564 3316 dropper.exe 90 PID 3316 wrote to memory of 3564 3316 dropper.exe 90 PID 3316 wrote to memory of 3644 3316 dropper.exe 93 PID 3316 wrote to memory of 3644 3316 dropper.exe 93 PID 1584 wrote to memory of 4628 1584 cmd.exe 106 PID 1584 wrote to memory of 4628 1584 cmd.exe 106 PID 4628 wrote to memory of 4224 4628 dropper.exe 107 PID 4628 wrote to memory of 4224 4628 dropper.exe 107 PID 4628 wrote to memory of 1580 4628 dropper.exe 109 PID 4628 wrote to memory of 1580 4628 dropper.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\dropper.exe"C:\Users\Admin\AppData\Local\Temp\dropper.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" diskdrive get Model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3564
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" diskdrive get Model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3956,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:81⤵PID:3896
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4072
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\dropper.exedropper.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" diskdrive get Model3⤵PID:4224
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" diskdrive get Model3⤵PID:1580
-
-