6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe
Size

73KB
MD5

5cc335f8d6ddfaf90050c6beae9de621
SHA1

c161a9917ff72da818ea5ba661b4dee1e726d6d9
SHA256

6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d
SHA512

03a10039c2b9aa00cc0fd2ba7099527618fb035541a03306640e83d3a80fdb26b65a711306dfac4add22e7a414651671301eb5e5decb556d68512986d590a28f
SSDEEP

1536:+X8aN37X4GpkvCVzLVKNrKNsKNaKN6X1C:+d7oGmaVzLYNWNLNBNI1C

Score

1^/10

Malware Config

Signatures

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1908	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe
Token: SeDebugPrivilege	276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1908	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe
276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 276	1908	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	16
PID 1908 wrote to memory of 276	1908	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	16
PID 1908 wrote to memory of 276	1908	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	16
PID 1908 wrote to memory of 276	1908	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	16
PID 276 wrote to memory of 1940	276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	18
PID 276 wrote to memory of 1940	276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	18
PID 276 wrote to memory of 1940	276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	18
PID 276 wrote to memory of 1940	276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	18
PID 276 wrote to memory of 1940	276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	18
PID 276 wrote to memory of 1940	276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	18
PID 276 wrote to memory of 1940	276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	18
PID 276 wrote to memory of 1940	276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	18
PID 276 wrote to memory of 1940	276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	18
PID 276 wrote to memory of 1940	276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	18
PID 276 wrote to memory of 1940	276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	18
PID 276 wrote to memory of 1940	276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	18
PID 276 wrote to memory of 1940	276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	18
PID 276 wrote to memory of 1940	276	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	18

C:\Users\Admin\AppData\Local\Temp\6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe
"C:\Users\Admin\AppData\Local\Temp\6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1908
- C:\ProgramData\pcdfdata\6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe
  C:\ProgramData\pcdfdata\6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:276
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/276-59-0x0000000000240000-0x0000000000247000-memory.dmp

Filesize
28KB

Download
memory/276-60-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/276-61-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1908-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1908-58-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1908-57-0x00000000003C0000-0x00000000003C7000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads