0acde791416ef240fc145106f6ff6f2840a0d7b99a30102d95dc663c835f5c0a

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c2c7664a605d6f9a5718b4b8f4f5178.exe
Size

458KB
MD5

0c2c7664a605d6f9a5718b4b8f4f5178
SHA1

3ed9b5119fe3ca8458fcdef3e346a0ab0f796481
SHA256

0acde791416ef240fc145106f6ff6f2840a0d7b99a30102d95dc663c835f5c0a
SHA512

4df3ebcbc7fa7c14a3b8d9792986d4516d26d3b95470a6382509fb83d516473eaafd4d686c3937abbd7bb88a170ef490048ebf4ed6825617c974c7dc81a74c09
SSDEEP

12288:m5FYuRsEPTjn0nLxgeQOeuEgNtTirdmPq:mQ+sErj0nLGuzTEdmy

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1824	systemcc

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\systemcc	0c2c7664a605d6f9a5718b4b8f4f5178.exe
File opened for modification	C:\Windows\systemcc	0c2c7664a605d6f9a5718b4b8f4f5178.exe
File created	C:\Windows\uninstal.BAT	0c2c7664a605d6f9a5718b4b8f4f5178.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4020	0c2c7664a605d6f9a5718b4b8f4f5178.exe
Token: SeDebugPrivilege	1824	systemcc

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1824	systemcc

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 4608	1824	systemcc	92
PID 1824 wrote to memory of 4608	1824	systemcc	92
PID 4020 wrote to memory of 1912	4020	0c2c7664a605d6f9a5718b4b8f4f5178.exe	93
PID 4020 wrote to memory of 1912	4020	0c2c7664a605d6f9a5718b4b8f4f5178.exe	93
PID 4020 wrote to memory of 1912	4020	0c2c7664a605d6f9a5718b4b8f4f5178.exe	93

C:\Users\Admin\AppData\Local\Temp\0c2c7664a605d6f9a5718b4b8f4f5178.exe
"C:\Users\Admin\AppData\Local\Temp\0c2c7664a605d6f9a5718b4b8f4f5178.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.BAT
  2⤵
  PID:1912

C:\Windows\systemcc
C:\Windows\systemcc
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Program Files\Internet Explorer\iEXpLOrE.exE
  "C:\Program Files\Internet Explorer\iEXpLOrE.exE"
  2⤵
  PID:4608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\systemcc

Filesize
458KB

MD5
0c2c7664a605d6f9a5718b4b8f4f5178

SHA1
3ed9b5119fe3ca8458fcdef3e346a0ab0f796481

SHA256
0acde791416ef240fc145106f6ff6f2840a0d7b99a30102d95dc663c835f5c0a

SHA512
4df3ebcbc7fa7c14a3b8d9792986d4516d26d3b95470a6382509fb83d516473eaafd4d686c3937abbd7bb88a170ef490048ebf4ed6825617c974c7dc81a74c09

Download Submit
C:\Windows\uninstal.BAT

Filesize
190B

MD5
3b6b38c88e2925d5c6484be815b9652a

SHA1
d2095c43f40f3c3ce6a79dc1c6d6fcf27c313bbe

SHA256
a3d86dc8adfe1037ab46a2a7ae4e8729f3181860c31f077600eff35901235a5f

SHA512
5385565c67405890afccd586b32eb4980e4f936898d202a6073e8b861fce5abb9787d05588aa9d70768921a21c3791fd5349cb31549c2fa109fae0c9d413db35

Download Submit
memory/4020-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4020-1-0x00000000022D0000-0x0000000002313000-memory.dmp

Filesize
268KB

Download
memory/4020-3-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/4020-2-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/4020-4-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/4020-5-0x0000000002510000-0x0000000002513000-memory.dmp

Filesize
12KB

Download
memory/4020-6-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/4020-7-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/4020-8-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/4020-9-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/4020-10-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/4020-12-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/4020-11-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/4020-13-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/4020-14-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/4020-15-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/4020-16-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/4020-17-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/4020-18-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/4020-19-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/4020-23-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/4020-20-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/4020-24-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/4020-25-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/4020-26-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/4020-27-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/4020-29-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/4020-28-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/4020-30-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/4020-32-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/4020-34-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/4020-35-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/4020-33-0x00000000027C0000-0x00000000027C1000-memory.dmp

Filesize
4KB

Download
memory/4020-31-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/4020-37-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/4020-36-0x00000000027D0000-0x00000000027D1000-memory.dmp

Filesize
4KB

Download
memory/4020-38-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/4020-39-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/4020-40-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/4020-41-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/4020-42-0x0000000002840000-0x0000000002841000-memory.dmp

Filesize
4KB

Download
memory/4020-43-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download
memory/4020-44-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/4020-45-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download
memory/4020-46-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download
memory/4020-48-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/4020-47-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/4020-49-0x0000000002A30000-0x0000000002A31000-memory.dmp

Filesize
4KB

Download
memory/4020-50-0x0000000002A60000-0x0000000002A61000-memory.dmp

Filesize
4KB

Download
memory/4020-51-0x0000000002A50000-0x0000000002A51000-memory.dmp

Filesize
4KB

Download
memory/4020-52-0x0000000002A70000-0x0000000002A71000-memory.dmp

Filesize
4KB

Download
memory/4020-53-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/4020-54-0x0000000002A90000-0x0000000002A91000-memory.dmp

Filesize
4KB

Download
memory/4020-55-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/4020-56-0x0000000002E20000-0x0000000002E21000-memory.dmp

Filesize
4KB

Download
memory/4020-57-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download
memory/4020-58-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/4020-59-0x0000000002E30000-0x0000000002E31000-memory.dmp

Filesize
4KB

Download
memory/4020-60-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/4020-61-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4020-62-0x0000000002E80000-0x0000000002E81000-memory.dmp

Filesize
4KB

Download
memory/4020-63-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/4020-64-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Filesize
4KB

Download
memory/4020-65-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download
memory/4020-158-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download