693e56d27b658947e6a9d0f18803cc38b430a9f203ad91cb680e6ea1acafe40f | Triage

Analysis

max time kernel
75s
max time network
112s
platform
windows10_x64
resource
win10v200722
submitted
28-08-2020 13:18

Sharing

Report Analysis Logs

General

Target

693e56d27b658947e6a9d0f18803cc38b430a9f203ad91cb680e6ea1acafe40f.dll
Size

12KB
MD5

8d79d99a1571e751f2672d2689c37081
SHA1

2b4d512d7218b97a8d1e6d8ed43b4ca9ba2b4b34
SHA256

693e56d27b658947e6a9d0f18803cc38b430a9f203ad91cb680e6ea1acafe40f
SHA512

6f5434bc4f16b05f3f62588109e5769b13172089993c85804a36359ea47c1a69b769d518921d110e4b52bf64444e834aec642ffb03f545eb756a01b0986debb7

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

8 904 rundll32.exe
Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 13a1feee4e7dd601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exe

description pid process

Token: SeShutdownPrivilege 1000 svchost.exe
Token: SeCreatePagefilePrivilege 1000 svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 508 wrote to memory of 904	508	rundll32.exe	rundll32.exe
PID 508 wrote to memory of 904	508	rundll32.exe	rundll32.exe
PID 508 wrote to memory of 904	508	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\693e56d27b658947e6a9d0f18803cc38b430a9f203ad91cb680e6ea1acafe40f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\693e56d27b658947e6a9d0f18803cc38b430a9f203ad91cb680e6ea1acafe40f.dll,#1
  2⤵
  - Blacklisted process makes network request
  PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-0-0x0000000000000000-mapping.dmp

Download