6cb26b88139833f950b2941acf3b9018fe212d224865da7f76e88b2bc8cba3a7

Analysis

max time kernel
165s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cb26b88139833f950b2941acf3b9018fe212d224865da7f76e88b2bc8cba3a7.exe
Size

135KB
MD5

3dbccb02949796bd3fe853d837cd65dc
SHA1

3fa94646b802b969a57b7550f0966db37c91e1e8
SHA256

6cb26b88139833f950b2941acf3b9018fe212d224865da7f76e88b2bc8cba3a7
SHA512

f1741a46b590eac8b5e3c2e18196afef529766320dd54d8554621224fe37b4e552a26cda71b1e46c758353032a4470d7a2a44d2200501db5d9374f42dc2fc3ec
SSDEEP

3072:R3mN7PPCxoMIiO1Nwhqk48MtgkxzQkmLckqFKa8OxacVout:R3mNjchZ48M+aQkackqFHpxTVoS

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4748	msprxysvc32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msprxysvc32.exe	6cb26b88139833f950b2941acf3b9018fe212d224865da7f76e88b2bc8cba3a7.exe
File opened for modification	C:\Windows\SysWOW64\msprxysvc32.exe	6cb26b88139833f950b2941acf3b9018fe212d224865da7f76e88b2bc8cba3a7.exe
File opened for modification	C:\Windows\SysWOW64\msprxysvc32.exe	msprxysvc32.exe
File created	C:\Windows\SysWOW64\msprxysvc32.exe	msprxysvc32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 4748	3988	6cb26b88139833f950b2941acf3b9018fe212d224865da7f76e88b2bc8cba3a7.exe	79
PID 3988 wrote to memory of 4748	3988	6cb26b88139833f950b2941acf3b9018fe212d224865da7f76e88b2bc8cba3a7.exe	79
PID 3988 wrote to memory of 4748	3988	6cb26b88139833f950b2941acf3b9018fe212d224865da7f76e88b2bc8cba3a7.exe	79
PID 4748 wrote to memory of 4500	4748	msprxysvc32.exe	82
PID 4748 wrote to memory of 4500	4748	msprxysvc32.exe	82
PID 4748 wrote to memory of 4500	4748	msprxysvc32.exe	82

C:\Users\Admin\AppData\Local\Temp\6cb26b88139833f950b2941acf3b9018fe212d224865da7f76e88b2bc8cba3a7.exe
"C:\Users\Admin\AppData\Local\Temp\6cb26b88139833f950b2941acf3b9018fe212d224865da7f76e88b2bc8cba3a7.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\SysWOW64\msprxysvc32.exe
  C:\Windows\system32\msprxysvc32.exe 1152 "C:\Users\Admin\AppData\Local\Temp\6cb26b88139833f950b2941acf3b9018fe212d224865da7f76e88b2bc8cba3a7.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat C:\Windows\SysWOW64\msprxysvc32.exe
    3⤵
    PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
136B

MD5
bfcf9cc6d1c37953dfa43312e2c36140

SHA1
07a4c0f29b282c34be24c312c4b920e479f4cee0

SHA256
bac7cce52aeba3a2e2ce2bb6aebf50ffa65530d0d51ca49a2abc7f4e43ce3ce5

SHA512
fb661474557e7168d4050607863b57649fa12a26ab9bd06078ae3254d003d76cfed4eac3d0a78a56eaf0ecc5b231d52788b6c8688cb14b0c86a37efe90f5f53a

Download Submit
C:\Windows\SysWOW64\msprxysvc32.exe

Filesize
135KB

MD5
3dbccb02949796bd3fe853d837cd65dc

SHA1
3fa94646b802b969a57b7550f0966db37c91e1e8

SHA256
6cb26b88139833f950b2941acf3b9018fe212d224865da7f76e88b2bc8cba3a7

SHA512
f1741a46b590eac8b5e3c2e18196afef529766320dd54d8554621224fe37b4e552a26cda71b1e46c758353032a4470d7a2a44d2200501db5d9374f42dc2fc3ec

Download Submit
C:\Windows\SysWOW64\msprxysvc32.exe

Filesize
135KB

MD5
3dbccb02949796bd3fe853d837cd65dc

SHA1
3fa94646b802b969a57b7550f0966db37c91e1e8

SHA256
6cb26b88139833f950b2941acf3b9018fe212d224865da7f76e88b2bc8cba3a7

SHA512
f1741a46b590eac8b5e3c2e18196afef529766320dd54d8554621224fe37b4e552a26cda71b1e46c758353032a4470d7a2a44d2200501db5d9374f42dc2fc3ec

Download Submit
memory/3988-132-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/3988-137-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/4500-138-0x0000000000000000-mapping.dmp

Download
memory/4748-133-0x0000000000000000-mapping.dmp

Download
memory/4748-136-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/4748-139-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads