6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252

Analysis

max time kernel
78s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 04:50

Target

6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Size

302KB
MD5

7acbb78f1e80e4d9a9935189ad815ed0
SHA1

b87ee1cb2185fb8ca8f18242550b5d388c5d2e17
SHA256

6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252
SHA512

8ad45c865ad5fc9c76fc17aa7769557c2c2ca91e439f0c7163a23ffb5be79fafb24bc58a068ef8bab7d32a39fa964d06d510a5692edd2a7ff96dab4dbe5dabf4
SSDEEP

6144:sr6WMMmZZThl14nDWgRAkP79GQn8xID0DMFAzJvFMH6KsG9:sr6QmgR3P79GLxe0DVjq6Ks4

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dllcache\qmgr.dll	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
File created	C:\Windows\SysWOW64\qmgr.dll	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
File opened for modification	C:\Windows\SysWOW64\qmgr.dll	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServicePackFiles\i386\qmgr.dll	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3184	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Token: SeDebugPrivilege	876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Token: SeDebugPrivilege	876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Token: SeDebugPrivilege	876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Token: SeDebugPrivilege	876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Token: SeDebugPrivilege	876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Token: SeDebugPrivilege	876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Token: SeIncBasePriorityPrivilege	876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
Token: SeDebugPrivilege	3184	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 3184	876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe	79
PID 876 wrote to memory of 3184	876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe	79
PID 876 wrote to memory of 3184	876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe	79
PID 876 wrote to memory of 4632	876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe	83
PID 876 wrote to memory of 4632	876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe	83
PID 876 wrote to memory of 4632	876	6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe	83

C:\Users\Admin\AppData\Local\Temp\6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe
"C:\Users\Admin\AppData\Local\Temp\6cc886083ad3de7a493f9bd9de4e8169ba8402a6b030eec7fa061f0f5ef4b252.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /t /im RSTray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\6CC886~1.EXE > nul
  2⤵
  PID:4632

memory/876-132-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/876-135-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download