6d56700e490fbb082d3ff3fbde1bdb8404c0dd033e05a0e6b63d649bb06b03c0

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-10-2024 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d56700e490fbb082d3ff3fbde1bdb8404c0dd033e05a0e6b63d649bb06b03c0.exe
Size

1.1MB
MD5

2fcc31707bfa6f3b9a82ef482e81f08f
SHA1

f820b95c7e9d10d951c3d48c2b491b64ed274534
SHA256

6d56700e490fbb082d3ff3fbde1bdb8404c0dd033e05a0e6b63d649bb06b03c0
SHA512

1cfa47e1a602467386b11f86a67252046cad119f378c2f09362efe60c7a9ce8e6ba26dd452d87e9dd6f7c1de00682a986495f4ec3708c15440441592a65fcbb9
SSDEEP

24576:Pt4rexG2D35fmUw5UpCZI3M3xr7KT8LwcCouwvxA688j:V4rexG2D3nw6pCZyMhvKrrTQxAl8j

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IsAbstract.vbs	6d56700e490fbb082d3ff3fbde1bdb8404c0dd033e05a0e6b63d649bb06b03c0.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1732	6d56700e490fbb082d3ff3fbde1bdb8404c0dd033e05a0e6b63d649bb06b03c0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	6d56700e490fbb082d3ff3fbde1bdb8404c0dd033e05a0e6b63d649bb06b03c0.exe
Token: SeDebugPrivilege	1732	6d56700e490fbb082d3ff3fbde1bdb8404c0dd033e05a0e6b63d649bb06b03c0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 4900	1732	6d56700e490fbb082d3ff3fbde1bdb8404c0dd033e05a0e6b63d649bb06b03c0.exe	30
PID 1732 wrote to memory of 4900	1732	6d56700e490fbb082d3ff3fbde1bdb8404c0dd033e05a0e6b63d649bb06b03c0.exe	30
PID 1732 wrote to memory of 4900	1732	6d56700e490fbb082d3ff3fbde1bdb8404c0dd033e05a0e6b63d649bb06b03c0.exe	30

C:\Users\Admin\AppData\Local\Temp\6d56700e490fbb082d3ff3fbde1bdb8404c0dd033e05a0e6b63d649bb06b03c0.exe
"C:\Users\Admin\AppData\Local\Temp\6d56700e490fbb082d3ff3fbde1bdb8404c0dd033e05a0e6b63d649bb06b03c0.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1732 -s 592
  2⤵
  PID:4900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-0-0x000007FEF57B3000-0x000007FEF57B4000-memory.dmp

Filesize
4KB

Download
memory/1732-1-0x0000000000EA0000-0x0000000000FC4000-memory.dmp

Filesize
1.1MB

Download
memory/1732-2-0x0000000000DB0000-0x0000000000E9E000-memory.dmp

Filesize
952KB

Download
memory/1732-3-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-4-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-16-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-20-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-18-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-14-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-12-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-10-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-8-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-6-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-22-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-32-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-46-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-64-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-66-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-62-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-60-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-58-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-56-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-54-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-52-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-50-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-48-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-44-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-42-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-40-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-38-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-36-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-34-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-30-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-28-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-26-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-24-0x0000000000DB0000-0x0000000000E99000-memory.dmp

Filesize
932KB

Download
memory/1732-1078-0x0000000000710000-0x0000000000772000-memory.dmp

Filesize
392KB

Download
memory/1732-1077-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/1732-1079-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/1732-1080-0x0000000000770000-0x00000000007BC000-memory.dmp

Filesize
304KB

Download
memory/1732-1081-0x0000000002660000-0x00000000026B4000-memory.dmp

Filesize
336KB

Download
memory/1732-1084-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/1732-1085-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download
memory/1732-1086-0x000007FEF57B3000-0x000007FEF57B4000-memory.dmp

Filesize
4KB

Download
memory/1732-1087-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

Filesize
9.9MB

Download