70e96ab0deb629da68b0af277376f4598c1062064beecedf3ee8d72de0a9b1a1 | Triage™

Analysis

max time kernel
148s
max time network
151s
platform
windows10_x64
resource
win10v200722
submitted
28/08/2020, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70e96ab0deb629da68b0af277376f4598c1062064beecedf3ee8d72de0a9b1a1.exe
Size 219KB
Sample200828-mdlq8d5fle
SHA256 70e96ab0deb629da68b0af277376f4598c1062064beecedf3ee8d72de0a9b1a1
MD5 a20a1b0d211c01eecdb475984c19fb4e
SHA1 012f01c9ba411189ef0cf8b37ccfc114004364a1
SHA512 b3f4b90899ea1a35a1a26d48ade94a0284e56d2b1902da665517c1dd0fa25d64f3232680d0322fff4e4cb364ff8dcbc3068294a2495a9c997053421dcfe53a50
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 63ce1ff1417dd601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	992	svchost.exe
Token: SeCreatePagefilePrivilege	992	svchost.exe

C:\Users\Admin\AppData\Local\Temp\70e96ab0deb629da68b0af277376f4598c1062064beecedf3ee8d72de0a9b1a1.exe
"C:\Users\Admin\AppData\Local\Temp\70e96ab0deb629da68b0af277376f4598c1062064beecedf3ee8d72de0a9b1a1.exe"
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads