Analysis
-
max time kernel
48s -
max time network
42s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-09-2021 06:13
Static task
static1
Behavioral task
behavioral1
Sample
70654 SSEBACT.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
70654 SSEBACT.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
-
Target
70654 SSEBACT.exe
-
Size
641KB
-
MD5
4e09874338d28600e8b84184f143bfe8
-
SHA1
488979983bfa154fbb27563454e67903c37e16c3
-
SHA256
ca87f3892de6e488e61c352cafc36fc06d0d8b6eb9fc4d5429ff92038c4b134f
-
SHA512
d58e1582e77fff96197fd7a5d463249ab619a9455a6d1425fdc913f42ac3b60a7fd46ed0f11cac00aee8a97055d86842f7fed1f85cb5a11c59d66a702d7212b2
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
70654 SSEBACT.exepid process 516 70654 SSEBACT.exe 516 70654 SSEBACT.exe 516 70654 SSEBACT.exe 516 70654 SSEBACT.exe 516 70654 SSEBACT.exe 516 70654 SSEBACT.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
70654 SSEBACT.exedescription pid process Token: SeDebugPrivilege 516 70654 SSEBACT.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
70654 SSEBACT.exedescription pid process target process PID 516 wrote to memory of 556 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 556 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 556 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 556 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 556 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 556 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 556 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 1520 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 1520 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 1520 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 1520 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 1520 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 1520 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 1520 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 784 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 784 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 784 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 784 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 784 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 784 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 784 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 1452 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 1452 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 1452 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 1452 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 1452 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 1452 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 1452 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 456 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 456 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 456 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 456 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 456 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 456 516 70654 SSEBACT.exe RegSvcs.exe PID 516 wrote to memory of 456 516 70654 SSEBACT.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70654 SSEBACT.exe"C:\Users\Admin\AppData\Local\Temp\70654 SSEBACT.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/516-59-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB
-
memory/516-61-0x00000000020F0000-0x00000000020F1000-memory.dmpFilesize
4KB
-
memory/516-62-0x0000000000450000-0x0000000000457000-memory.dmpFilesize
28KB
-
memory/516-63-0x0000000005F10000-0x0000000005F73000-memory.dmpFilesize
396KB
-
memory/516-64-0x0000000001F80000-0x0000000001FBC000-memory.dmpFilesize
240KB