cb72d852d54f5b91cafc4d733e2b40b758eaefff4bd397790690800619b48667

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fd401e45c5f3ba2e0feafa245629034.exe
Size

601KB
MD5

6fd401e45c5f3ba2e0feafa245629034
SHA1

7f9a81d977d0126efff05e33bc6ded77a4d76565
SHA256

cb72d852d54f5b91cafc4d733e2b40b758eaefff4bd397790690800619b48667
SHA512

dcf44efd43f905445f4ff7afde5a85a755882db7bcccc5e7ed3d399ba8b9d25cdc121a5722a247aa6ecef902a9169db23e387313393c28f72b0d2dec78236179
SSDEEP

12288:dhInWl0lTZhaoFx4L1ROiKfC6SjF3Z4mxxhgnaBn7qk:nIiaTaoF+OiySjQmX6aQk

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1244	svchost.ini

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchost.ini	6fd401e45c5f3ba2e0feafa245629034.exe
File opened for modification	C:\Windows\svchost.ini	6fd401e45c5f3ba2e0feafa245629034.exe

Program crash 1 IoCs

pid	pid_target	Process
1952	1244	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	6fd401e45c5f3ba2e0feafa245629034.exe
Token: SeDebugPrivilege	1244	svchost.ini

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 700	1244	svchost.ini	94
PID 1244 wrote to memory of 700	1244	svchost.ini	94

C:\Users\Admin\AppData\Local\Temp\6fd401e45c5f3ba2e0feafa245629034.exe
"C:\Users\Admin\AppData\Local\Temp\6fd401e45c5f3ba2e0feafa245629034.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 680
1⤵
- Program crash
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1244 -ip 1244
1⤵
PID:2252

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
1⤵
PID:700

C:\Windows\svchost.ini
C:\Windows\svchost.ini
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svchost.ini

Filesize
601KB

MD5
6fd401e45c5f3ba2e0feafa245629034

SHA1
7f9a81d977d0126efff05e33bc6ded77a4d76565

SHA256
cb72d852d54f5b91cafc4d733e2b40b758eaefff4bd397790690800619b48667

SHA512
dcf44efd43f905445f4ff7afde5a85a755882db7bcccc5e7ed3d399ba8b9d25cdc121a5722a247aa6ecef902a9169db23e387313393c28f72b0d2dec78236179

Download Submit
memory/1244-61-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-83-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/1244-50-0x0000000000E40000-0x0000000000E94000-memory.dmp

Filesize
336KB

Download
memory/1244-51-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-52-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-56-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-57-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-58-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-49-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/1244-59-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-64-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-63-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-62-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-66-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-67-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-65-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-60-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-55-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-53-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/1244-54-0x0000000002060000-0x0000000002160000-memory.dmp

Filesize
1024KB

Download
memory/3556-6-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/3556-40-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-23-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-24-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-25-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-26-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-27-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-28-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-31-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-32-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-33-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-34-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-35-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-36-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-37-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-38-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-39-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-46-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/3556-45-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-44-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-43-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-42-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/3556-41-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/3556-22-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-21-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-2-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/3556-4-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/3556-8-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/3556-5-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/3556-0-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/3556-7-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/3556-9-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/3556-10-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/3556-11-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/3556-12-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/3556-13-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/3556-14-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/3556-15-0x00000000034F0000-0x00000000034F1000-memory.dmp

Filesize
4KB

Download
memory/3556-16-0x00000000034F0000-0x00000000034F1000-memory.dmp

Filesize
4KB

Download
memory/3556-17-0x00000000034F0000-0x00000000034F1000-memory.dmp

Filesize
4KB

Download
memory/3556-18-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-19-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-20-0x00000000034F0000-0x000000000350B000-memory.dmp

Filesize
108KB

Download
memory/3556-3-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/3556-1-0x00000000022E0000-0x0000000002334000-memory.dmp

Filesize
336KB

Download
memory/3556-84-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download