fec30d4f97573ff583ac63cfd700c3992d5163b220d24aad9f0e441c551febbf

Analysis

max time kernel
103s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fec30d4f97573ff583ac63cfd700c3992d5163b220d24aad9f0e441c551febbf.exe
Size

70KB
MD5

18b4185bee653a4dd48d8c583fac2d35
SHA1

52153902002a6806b9521df8d9d3a5f40d47058f
SHA256

fec30d4f97573ff583ac63cfd700c3992d5163b220d24aad9f0e441c551febbf
SHA512

799325376117f499376fd6691fd5763b58a6b75168b81ebcc2be36b8533c3eb48f62559d4876ac5a90228d17d2ff1fd83fff32eee7f9e6c6121b02f6fb78df1f
SSDEEP

1536:kBej95nc6HSpg+UIqnEixqDnLa95bOVwp+zDX:VLnc6NoqnxqKfl8zDX

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

evasion

pid	Process
4592	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4592	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 4744	4996	fec30d4f97573ff583ac63cfd700c3992d5163b220d24aad9f0e441c551febbf.exe	82
PID 4996 wrote to memory of 4744	4996	fec30d4f97573ff583ac63cfd700c3992d5163b220d24aad9f0e441c551febbf.exe	82
PID 4996 wrote to memory of 4744	4996	fec30d4f97573ff583ac63cfd700c3992d5163b220d24aad9f0e441c551febbf.exe	82
PID 4744 wrote to memory of 2436	4744	cmd.exe	83
PID 4744 wrote to memory of 2436	4744	cmd.exe	83
PID 4744 wrote to memory of 2436	4744	cmd.exe	83
PID 4744 wrote to memory of 4592	4744	cmd.exe	84
PID 4744 wrote to memory of 4592	4744	cmd.exe	84
PID 4744 wrote to memory of 4592	4744	cmd.exe	84
PID 4744 wrote to memory of 4236	4744	cmd.exe	85
PID 4744 wrote to memory of 4236	4744	cmd.exe	85
PID 4744 wrote to memory of 4236	4744	cmd.exe	85
PID 4744 wrote to memory of 1008	4744	cmd.exe	86
PID 4744 wrote to memory of 1008	4744	cmd.exe	86
PID 4744 wrote to memory of 1008	4744	cmd.exe	86
PID 4744 wrote to memory of 4216	4744	cmd.exe	87
PID 4744 wrote to memory of 4216	4744	cmd.exe	87
PID 4744 wrote to memory of 4216	4744	cmd.exe	87
PID 4744 wrote to memory of 1672	4744	cmd.exe	88
PID 4744 wrote to memory of 1672	4744	cmd.exe	88
PID 4744 wrote to memory of 1672	4744	cmd.exe	88
PID 4744 wrote to memory of 992	4744	cmd.exe	89
PID 4744 wrote to memory of 992	4744	cmd.exe	89
PID 4744 wrote to memory of 992	4744	cmd.exe	89
PID 4744 wrote to memory of 1752	4744	cmd.exe	90
PID 4744 wrote to memory of 1752	4744	cmd.exe	90
PID 4744 wrote to memory of 1752	4744	cmd.exe	90
PID 4744 wrote to memory of 2720	4744	cmd.exe	91
PID 4744 wrote to memory of 2720	4744	cmd.exe	91
PID 4744 wrote to memory of 2720	4744	cmd.exe	91
PID 4744 wrote to memory of 3800	4744	cmd.exe	92
PID 4744 wrote to memory of 3800	4744	cmd.exe	92
PID 4744 wrote to memory of 3800	4744	cmd.exe	92
PID 4744 wrote to memory of 1676	4744	cmd.exe	93
PID 4744 wrote to memory of 1676	4744	cmd.exe	93
PID 4744 wrote to memory of 1676	4744	cmd.exe	93
PID 4744 wrote to memory of 2712	4744	cmd.exe	94
PID 4744 wrote to memory of 2712	4744	cmd.exe	94
PID 4744 wrote to memory of 2712	4744	cmd.exe	94
PID 4744 wrote to memory of 4456	4744	cmd.exe	95
PID 4744 wrote to memory of 4456	4744	cmd.exe	95
PID 4744 wrote to memory of 4456	4744	cmd.exe	95
PID 4744 wrote to memory of 344	4744	cmd.exe	96
PID 4744 wrote to memory of 344	4744	cmd.exe	96
PID 4744 wrote to memory of 344	4744	cmd.exe	96
PID 4744 wrote to memory of 224	4744	cmd.exe	97
PID 4744 wrote to memory of 224	4744	cmd.exe	97
PID 4744 wrote to memory of 224	4744	cmd.exe	97
PID 4744 wrote to memory of 4560	4744	cmd.exe	98
PID 4744 wrote to memory of 4560	4744	cmd.exe	98
PID 4744 wrote to memory of 4560	4744	cmd.exe	98
PID 4744 wrote to memory of 1812	4744	cmd.exe	99
PID 4744 wrote to memory of 1812	4744	cmd.exe	99
PID 4744 wrote to memory of 1812	4744	cmd.exe	99
PID 4744 wrote to memory of 2180	4744	cmd.exe	100
PID 4744 wrote to memory of 2180	4744	cmd.exe	100
PID 4744 wrote to memory of 2180	4744	cmd.exe	100
PID 4744 wrote to memory of 1280	4744	cmd.exe	101
PID 4744 wrote to memory of 1280	4744	cmd.exe	101
PID 4744 wrote to memory of 1280	4744	cmd.exe	101
PID 4744 wrote to memory of 1080	4744	cmd.exe	102
PID 4744 wrote to memory of 1080	4744	cmd.exe	102
PID 4744 wrote to memory of 1080	4744	cmd.exe	102
PID 4744 wrote to memory of 4248	4744	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\fec30d4f97573ff583ac63cfd700c3992d5163b220d24aad9f0e441c551febbf.exe
"C:\Users\Admin\AppData\Local\Temp\fec30d4f97573ff583ac63cfd700c3992d5163b220d24aad9f0e441c551febbf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\a69033.cmd "C:\Users\Admin\AppData\Local\Temp\fec30d4f97573ff583ac63cfd700c3992d5163b220d24aad9f0e441c551febbf.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=58
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM aoltpsd3.exe /IM waol.exe /IM aolsoftware.exe /IM AOlacsd.exe /IM aol.exe /IM AOLdial.exe /IM shellmon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=58
    3⤵
    PID:4236
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=57
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=56
    3⤵
    PID:4216
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=55
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=54
    3⤵
    PID:992
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=53
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=52
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=51
    3⤵
    PID:3800
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=50
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=49
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=48
    3⤵
    PID:4456
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=47
    3⤵
    PID:344
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=46
    3⤵
    PID:224
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=45
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=44
    3⤵
    PID:1812
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=43
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=42
    3⤵
    PID:1280
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=41
    3⤵
    PID:1080
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=12 cols=40
    3⤵
    PID:4248
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=11 cols=40
    3⤵
    PID:3308
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=10 cols=40
    3⤵
    PID:328
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=9 cols=40
    3⤵
    PID:2164
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=8 cols=40
    3⤵
    PID:520
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=7 cols=40
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=6 cols=40
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=5 cols=40
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=4 cols=40
    3⤵
    PID:2588
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=3 cols=40
    3⤵
    PID:1296
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=2 cols=40
    3⤵
    PID:1344
- - C:\Windows\SysWOW64\mode.com
    mode con: lines=1 cols=40
    3⤵
    PID:456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a69033.cmd

Filesize
1KB

MD5
efd585a2fa39fc8b219df04d8691ee2b

SHA1
681747d40504c2c81311f16247a75c5352ef48be

SHA256
87fc237025e07d331ad1fc23301f3df68f683db1011326431e3076b7340702e9

SHA512
ea1a7a72610761614583944297ff65d4fcd8c85c6458cc6cebe623dfd30364938f69733e5f0c49b09a0fac1fda52fa48deee761ffb83129ef04c48aab4b2c273

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads