a828d218d3d99d46ff48122117e2ecb53de196f442702676ed4e4cf0544b4da3 | Triage

Analysis

max time kernel
75s
max time network
112s
platform
windows10_x64
resource
win10v200722
submitted
06-09-2020 16:05

Sharing

Report Analysis Logs

General

Target

a828d218d3d99d46ff48122117e2ecb53de196f442702676ed4e4cf0544b4da3.exe
Size

126KB
MD5

8dea49404813ec8503c315c7634055c2
SHA1

50755b54adddcb85e6634ddaaa5deea7aaf79daf
SHA256

a828d218d3d99d46ff48122117e2ecb53de196f442702676ed4e4cf0544b4da3
SHA512

a9dfd5ae905725ffa36ac5fcc6a39bea99e546c03a6a941a384ad678a7cdc50d2a97775e81bdea6ffb3c25fd136a6f1047b9a2a251517744711e779944061ff4

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 02f7c7bf7884d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exe

description pid process

Token: SeShutdownPrivilege 420 svchost.exe
Token: SeCreatePagefilePrivilege 420 svchost.exe

C:\Users\Admin\AppData\Local\Temp\a828d218d3d99d46ff48122117e2ecb53de196f442702676ed4e4cf0544b4da3.exe
"C:\Users\Admin\AppData\Local\Temp\a828d218d3d99d46ff48122117e2ecb53de196f442702676ed4e4cf0544b4da3.exe"
1⤵
PID:3888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:420

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...