4fe83230cc6129f02f0fc96fb7ea254d97bcd886125703f4dabc9498a7c02efb | Triage™

Analysis

max time kernel
76s
max time network
113s
platform
windows10_x64
resource
win10v200722
submitted
01/09/2020, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4fe83230cc6129f02f0fc96fb7ea254d97bcd886125703f4dabc9498a7c02efb.exe
Size 11.4MB
Sample200901-vzhead4ke2
SHA256 4fe83230cc6129f02f0fc96fb7ea254d97bcd886125703f4dabc9498a7c02efb
MD5 2311a7456db33780f4a8c0651b80f72d
SHA1 a3e7f3b30a79a1b1651bfc4ed57d6e5560366d5d
SHA512 847503f7497bf38550d67813b28083c6ad2b0e2459c78cbbe32ea6c8accf7279fa88b6e081693a075e8c45c88627be14341714cdb3402e84a99884a99e8b9145
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 3734c5a75180d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	576	svchost.exe
Token: SeCreatePagefilePrivilege	576	svchost.exe

C:\Users\Admin\AppData\Local\Temp\4fe83230cc6129f02f0fc96fb7ea254d97bcd886125703f4dabc9498a7c02efb.exe
"C:\Users\Admin\AppData\Local\Temp\4fe83230cc6129f02f0fc96fb7ea254d97bcd886125703f4dabc9498a7c02efb.exe"
1⤵
PID:3888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads