6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe
Size

73KB
MD5

5cc335f8d6ddfaf90050c6beae9de621
SHA1

c161a9917ff72da818ea5ba661b4dee1e726d6d9
SHA256

6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d
SHA512

03a10039c2b9aa00cc0fd2ba7099527618fb035541a03306640e83d3a80fdb26b65a711306dfac4add22e7a414651671301eb5e5decb556d68512986d590a28f
SSDEEP

1536:+X8aN37X4GpkvCVzLVKNrKNsKNaKN6X1C:+d7oGmaVzLYNWNLNBNI1C

Score

1^/10

Malware Config

Signatures

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2708	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe
Token: SeDebugPrivilege	2308	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2308	2708	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	82
PID 2708 wrote to memory of 2308	2708	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	82
PID 2708 wrote to memory of 2308	2708	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	82
PID 2308 wrote to memory of 4328	2308	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	83
PID 2308 wrote to memory of 4328	2308	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	83
PID 2308 wrote to memory of 4328	2308	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	83
PID 2308 wrote to memory of 4328	2308	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	83
PID 2308 wrote to memory of 4328	2308	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	83
PID 2308 wrote to memory of 4328	2308	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	83
PID 2308 wrote to memory of 4328	2308	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	83
PID 2308 wrote to memory of 4328	2308	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	83
PID 2308 wrote to memory of 4328	2308	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	83
PID 2308 wrote to memory of 4328	2308	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	83
PID 2308 wrote to memory of 4328	2308	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	83
PID 2308 wrote to memory of 4328	2308	6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe	83

C:\Users\Admin\AppData\Local\Temp\6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe
"C:\Users\Admin\AppData\Local\Temp\6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708
- C:\ProgramData\pcdfdata\6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe
  C:\ProgramData\pcdfdata\6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-135-0x00000000004B0000-0x00000000004B7000-memory.dmp

Filesize
28KB

Download
memory/2308-136-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2308-142-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2708-133-0x0000000002030000-0x0000000002037000-memory.dmp

Filesize
28KB

Download
memory/2708-134-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4328-137-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads