6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 04:50

Target

6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Size

302KB
MD5

7acbb78f1e80e4d9a9935189ad815ed0
SHA1

b87ee1cb2185fb8ca8f18242550b5d388c5d2e17
SHA256

6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252
SHA512

8ad45c865ad5fc9c76fc17aa7769557c2c2ca91e439f0c7163a23ffb5be79fafb24bc58a068ef8bab7d32a39fa964d06d510a5692edd2a7ff96dab4dbe5dabf4
SSDEEP

6144:sr6WMMmZZThl14nDWgRAkP79GQn8xID0DMFAzJvFMH6KsG9:sr6QmgR3P79GLxe0DVjq6Ks4

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1888	cmd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\qmgr.dll	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
File created	C:\Windows\SysWOW64\dllcache\qmgr.dll	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
File created	C:\Windows\SysWOW64\qmgr.dll	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServicePackFiles\i386\qmgr.dll	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
864	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Token: SeDebugPrivilege	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Token: SeDebugPrivilege	864	taskkill.exe
Token: SeDebugPrivilege	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Token: SeDebugPrivilege	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Token: SeDebugPrivilege	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Token: SeDebugPrivilege	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Token: SeDebugPrivilege	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Token: SeIncBasePriorityPrivilege	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 864	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe	28
PID 1752 wrote to memory of 864	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe	28
PID 1752 wrote to memory of 864	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe	28
PID 1752 wrote to memory of 864	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe	28
PID 1752 wrote to memory of 1888	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe	31
PID 1752 wrote to memory of 1888	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe	31
PID 1752 wrote to memory of 1888	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe	31
PID 1752 wrote to memory of 1888	1752	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe	31

C:\Users\Admin\AppData\Local\Temp\6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
"C:\Users\Admin\AppData\Local\Temp\6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /t /im RSTray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\6CC886~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1888

memory/1752-54-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download