e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27 | Triage

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-en-20211208
submitted
11-02-2022 02:32

Sharing

Report Analysis Logs

General

Target

e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exe
Size

8KB
MD5

f4c9178895e50ad8d4cdc8c6298ed6ef
SHA1

3cd35638dcdccf62f7940da5676dfb5957251797
SHA256

e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27
SHA512

f1d06872e632cb29819412c4ede205a0c3c75bdf9e17bb5784f8acfe81811a2a797bceaf55ef4802d77c1ba1dd9f4eab4d95919f83641e30ceb8fa6718a17a02

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exe

description pid process

Token: SeDebugPrivilege 604 e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exe

C:\Users\Admin\AppData\Local\Temp\e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exe
"C:\Users\Admin\AppData\Local\Temp\e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:604

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/604-53-0x0000000000A90000-0x0000000000A98000-memory.dmp

Filesize
32KB

Download
memory/604-54-0x000007FEF5873000-0x000007FEF5874000-memory.dmp

Filesize
4KB

Download
memory/604-55-0x000000001B2B0000-0x000000001B2B2000-memory.dmp

Filesize
8KB

Download