6ed509aac6bee06c6ef1951a1b0535276fcfadd793a6234db05e32923fcf9c4a

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 13:25

Target

6ed509aac6bee06c6ef1951a1b0535276fcfadd793a6234db05e32923fcf9c4a.exe
Size

1.0MB
MD5

82b85a1cfdf49cc66ef4c0c7d91cd50a
SHA1

fa6cb04bd912f765fab8a24dbb3660031d2b1278
SHA256

6ed509aac6bee06c6ef1951a1b0535276fcfadd793a6234db05e32923fcf9c4a
SHA512

e1a22fccf7894eeca41e3262d6387c3e29a68cc6ad8041a9ca04a727a1847e647b7c36d594f20ffdf3462c2ceedd83adee7cb1df72879327a82f30757452890a
SSDEEP

3072:jCzwM6BRQDtCie1NmxnvjlgtAXvEivJls:jCIuyOl96

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3428	sislog.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sislog.exe	6ed509aac6bee06c6ef1951a1b0535276fcfadd793a6234db05e32923fcf9c4a.exe
File opened for modification	C:\Windows\SysWOW64\sislog.exe	6ed509aac6bee06c6ef1951a1b0535276fcfadd793a6234db05e32923fcf9c4a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	912	6ed509aac6bee06c6ef1951a1b0535276fcfadd793a6234db05e32923fcf9c4a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 5040	912	6ed509aac6bee06c6ef1951a1b0535276fcfadd793a6234db05e32923fcf9c4a.exe	81
PID 912 wrote to memory of 5040	912	6ed509aac6bee06c6ef1951a1b0535276fcfadd793a6234db05e32923fcf9c4a.exe	81
PID 912 wrote to memory of 5040	912	6ed509aac6bee06c6ef1951a1b0535276fcfadd793a6234db05e32923fcf9c4a.exe	81

C:\Users\Admin\AppData\Local\Temp\6ed509aac6bee06c6ef1951a1b0535276fcfadd793a6234db05e32923fcf9c4a.exe
"C:\Users\Admin\AppData\Local\Temp\6ed509aac6bee06c6ef1951a1b0535276fcfadd793a6234db05e32923fcf9c4a.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\6ED509~1.EXE > nul
  2⤵
  PID:5040

C:\Windows\SysWOW64\sislog.exe
C:\Windows\SysWOW64\sislog.exe
1⤵
- Executes dropped EXE
PID:3428

C:\Windows\SysWOW64\sislog.exe

Filesize
1.0MB

MD5
82b85a1cfdf49cc66ef4c0c7d91cd50a

SHA1
fa6cb04bd912f765fab8a24dbb3660031d2b1278

SHA256
6ed509aac6bee06c6ef1951a1b0535276fcfadd793a6234db05e32923fcf9c4a

SHA512
e1a22fccf7894eeca41e3262d6387c3e29a68cc6ad8041a9ca04a727a1847e647b7c36d594f20ffdf3462c2ceedd83adee7cb1df72879327a82f30757452890a

Download Submit
C:\Windows\SysWOW64\sislog.exe

Filesize
1.0MB

MD5
82b85a1cfdf49cc66ef4c0c7d91cd50a

SHA1
fa6cb04bd912f765fab8a24dbb3660031d2b1278

SHA256
6ed509aac6bee06c6ef1951a1b0535276fcfadd793a6234db05e32923fcf9c4a

SHA512
e1a22fccf7894eeca41e3262d6387c3e29a68cc6ad8041a9ca04a727a1847e647b7c36d594f20ffdf3462c2ceedd83adee7cb1df72879327a82f30757452890a

Download Submit