6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe
Size

76KB
MD5

6aded4134c066b7d93b41f1f2ee86ca7
SHA1

e82105b549e20665ebbbb2816e0274687220edf4
SHA256

6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b
SHA512

20bc997d4f803b0fbbe135c91244a8f6f5452ad33f17cb2f317135d40d1e7c28ded333fb490381c871f5c3e97a6066b95e3cdc6191f90f5f022c539fe5b5bf23
SSDEEP

1536:ffcwS9Pgw9j9mHLLmTRYTRRTRTTR3cweX:Cl9jkHLLm9Y9R9T9JeX

Score

1^/10

Malware Config

Signatures

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5108	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5108	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe
Token: SeDebugPrivilege	4688	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4688	5108	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	83
PID 5108 wrote to memory of 4688	5108	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	83
PID 5108 wrote to memory of 4688	5108	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	83
PID 4688 wrote to memory of 4760	4688	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	84
PID 4688 wrote to memory of 4760	4688	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	84
PID 4688 wrote to memory of 4760	4688	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	84
PID 4688 wrote to memory of 4760	4688	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	84
PID 4688 wrote to memory of 4760	4688	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	84
PID 4688 wrote to memory of 4760	4688	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	84
PID 4688 wrote to memory of 4760	4688	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	84
PID 4688 wrote to memory of 4760	4688	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	84
PID 4688 wrote to memory of 4760	4688	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	84
PID 4688 wrote to memory of 4760	4688	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	84
PID 4688 wrote to memory of 4760	4688	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	84
PID 4688 wrote to memory of 4760	4688	6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe	84

C:\Users\Admin\AppData\Local\Temp\6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe
"C:\Users\Admin\AppData\Local\Temp\6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108
- C:\ProgramData\pcdfdata\6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe
  C:\ProgramData\pcdfdata\6b8c9e1bb57f58d9e669518ae8d967fd973a1e722240e180d12cbda1eb7c518b.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4688-135-0x00000000004B0000-0x00000000004B7000-memory.dmp

Filesize
28KB

Download
memory/4688-136-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4688-143-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4760-138-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/5108-132-0x00000000004A0000-0x00000000004A7000-memory.dmp

Filesize
28KB

Download
memory/5108-133-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/5108-137-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads