d09dd35df9bfefd16710a70584eef878faa664db8e4e22460ad73a97d0b8f9be | Triage™

Analysis

max time kernel
76s
max time network
115s
platform
windows10_x64
resource
win10v200722
submitted
01/09/2020, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d09dd35df9bfefd16710a70584eef878faa664db8e4e22460ad73a97d0b8f9be.exe
Size 5.9MB
Sample200901-xjyc5mvbxe
SHA256 d09dd35df9bfefd16710a70584eef878faa664db8e4e22460ad73a97d0b8f9be
MD5 46105749e23a968b63998becd535acbc
SHA1 d1dd626e2fd1547bc81167173d194b3ae3e38109
SHA512 576df341161609b2bf59b0e72e63bec9231e8ae697518f3c54e90891d9235b1a3bded5ae20511f0d4af261fba5c969da89d91ec886158b4f1bf1bbfc888fe3ac
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = b00c37cf5180d601	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1236	svchost.exe
Token: SeCreatePagefilePrivilege	1236	svchost.exe

C:\Users\Admin\AppData\Local\Temp\d09dd35df9bfefd16710a70584eef878faa664db8e4e22460ad73a97d0b8f9be.exe
"C:\Users\Admin\AppData\Local\Temp\d09dd35df9bfefd16710a70584eef878faa664db8e4e22460ad73a97d0b8f9be.exe"
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads