c6cfcdeb73dc70ee77fa1c771fba408d96ed8f013c21e9ce32494076c4c7309e

Analysis

max time kernel
161s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 21:31

Target

c6cfcdeb73dc70ee77fa1c771fba408d96ed8f013c21e9ce32494076c4c7309e.exe
Size

371KB
MD5

413fdb2055357b12088cf2eb4eb363a6
SHA1

975d0ad9c05e40716bb730e97245b4b1bff83285
SHA256

c6cfcdeb73dc70ee77fa1c771fba408d96ed8f013c21e9ce32494076c4c7309e
SHA512

9d5fa6dfac237d5747a412588cd14ec306b7c3720e2370f4fabc0addee70a57a53de5eac4cabe78bfa9ecb5f96e57e7f0833bae5ee1ca25aa758e1b318538903
SSDEEP

6144:ALNk6l1WtdwKLm5BBoVJmoqEA1e54ye2SblCRptCFR1loJm4/NCXGtHf:0Nk6rWtCPEHqN1e5LCbYyx4VFH

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4800	c9987.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\office.exe	c6cfcdeb73dc70ee77fa1c771fba408d96ed8f013c21e9ce32494076c4c7309e.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\office.exe	c9987.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\office.exe	c9987.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\c9987.exe	c6cfcdeb73dc70ee77fa1c771fba408d96ed8f013c21e9ce32494076c4c7309e.exe
File opened for modification	C:\Windows\c9987.exe	c6cfcdeb73dc70ee77fa1c771fba408d96ed8f013c21e9ce32494076c4c7309e.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	4800	c9987.exe
Token: SeIncBasePriorityPrivilege	4800	c9987.exe
Token: 33	1188	c6cfcdeb73dc70ee77fa1c771fba408d96ed8f013c21e9ce32494076c4c7309e.exe
Token: SeIncBasePriorityPrivilege	1188	c6cfcdeb73dc70ee77fa1c771fba408d96ed8f013c21e9ce32494076c4c7309e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 4800	1188	c6cfcdeb73dc70ee77fa1c771fba408d96ed8f013c21e9ce32494076c4c7309e.exe	19
PID 1188 wrote to memory of 4800	1188	c6cfcdeb73dc70ee77fa1c771fba408d96ed8f013c21e9ce32494076c4c7309e.exe	19
PID 1188 wrote to memory of 4800	1188	c6cfcdeb73dc70ee77fa1c771fba408d96ed8f013c21e9ce32494076c4c7309e.exe	19

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\office.exe

Filesize
371KB

MD5
413fdb2055357b12088cf2eb4eb363a6

SHA1
975d0ad9c05e40716bb730e97245b4b1bff83285

SHA256
c6cfcdeb73dc70ee77fa1c771fba408d96ed8f013c21e9ce32494076c4c7309e

SHA512
9d5fa6dfac237d5747a412588cd14ec306b7c3720e2370f4fabc0addee70a57a53de5eac4cabe78bfa9ecb5f96e57e7f0833bae5ee1ca25aa758e1b318538903

Download Submit
C:\Windows\c9987.exe

Filesize
371KB

MD5
413fdb2055357b12088cf2eb4eb363a6

SHA1
975d0ad9c05e40716bb730e97245b4b1bff83285

SHA256
c6cfcdeb73dc70ee77fa1c771fba408d96ed8f013c21e9ce32494076c4c7309e

SHA512
9d5fa6dfac237d5747a412588cd14ec306b7c3720e2370f4fabc0addee70a57a53de5eac4cabe78bfa9ecb5f96e57e7f0833bae5ee1ca25aa758e1b318538903

Download Submit
C:\Windows\c9987.exe

Filesize
371KB

MD5
413fdb2055357b12088cf2eb4eb363a6

SHA1
975d0ad9c05e40716bb730e97245b4b1bff83285

SHA256
c6cfcdeb73dc70ee77fa1c771fba408d96ed8f013c21e9ce32494076c4c7309e

SHA512
9d5fa6dfac237d5747a412588cd14ec306b7c3720e2370f4fabc0addee70a57a53de5eac4cabe78bfa9ecb5f96e57e7f0833bae5ee1ca25aa758e1b318538903

Download Submit