6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b

Analysis

max time kernel
44s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe
Size

76KB
MD5

6aded4134c066b7d93b41f1f2ee86ca7
SHA1

e82105b549e20665ebbbb2816e0274687220edf4
SHA256

6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b
SHA512

20bc997d4f803b0fbbe135c91244a8f6f5452ad33f17cb2f317135d40d1e7c28ded333fb490381c871f5c3e97a6066b95e3cdc6191f90f5f022c539fe5b5bf23
SSDEEP

1536:ffcwS9Pgw9j9mHLLmTRYTRRTRTTR3cweX:Cl9jkHLLm9Y9R9T9JeX

Score

1^/10

Malware Config

Signatures

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2016	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe
Token: SeDebugPrivilege	936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2016	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe
936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 936	2016	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	28
PID 2016 wrote to memory of 936	2016	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	28
PID 2016 wrote to memory of 936	2016	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	28
PID 2016 wrote to memory of 936	2016	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	28
PID 936 wrote to memory of 1496	936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	29
PID 936 wrote to memory of 1496	936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	29
PID 936 wrote to memory of 1496	936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	29
PID 936 wrote to memory of 1496	936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	29
PID 936 wrote to memory of 1496	936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	29
PID 936 wrote to memory of 1496	936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	29
PID 936 wrote to memory of 1496	936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	29
PID 936 wrote to memory of 1496	936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	29
PID 936 wrote to memory of 1496	936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	29
PID 936 wrote to memory of 1496	936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	29
PID 936 wrote to memory of 1496	936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	29
PID 936 wrote to memory of 1496	936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	29
PID 936 wrote to memory of 1496	936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	29
PID 936 wrote to memory of 1496	936	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	29

C:\Users\Admin\AppData\Local\Temp\6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe
"C:\Users\Admin\AppData\Local\Temp\6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2016
- C:\ProgramData\pcdfdata\6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe
  C:\ProgramData\pcdfdata\6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/936-59-0x0000000000240000-0x0000000000247000-memory.dmp

Filesize
28KB

Download
memory/936-60-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/936-62-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2016-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/2016-58-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2016-57-0x00000000003C0000-0x00000000003C7000-memory.dmp

Filesize
28KB

Download
memory/2016-61-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads