434177ceff91fba2dd70971c6f1b2040e399d32e76a18e993e8f5eb48f61bd98 | Triage

Resubmissions

11-10-2022 15:18

221011-sptxcabdc2 7

08-09-2020 12:55

200908-wqmezttr6a 4

Analysis

max time kernel
77s
max time network
110s
platform
windows10_x64
resource
win10v200722
submitted
08-09-2020 12:55

Sharing

Report Analysis Logs

General

Target

pidor.bmp.bin.exe
Size

148KB
MD5

a2df9737790cf786fc6ad4804d33544a
SHA1

8b3841b26d65483582ce4a96cb2d2bc3ae2924ab
SHA256

fb43eec620345d76ee95aaad3e5a28cdc43d644347f5c56da41ea117b72d3623
SHA512

0df7d8bfdc7a89193111650a6125edfd4eae384ce6b425b05013bca8eed9e4323f97bc5231a13bbc57393be2b3482dd8a88a49e97624305931d7c2cef5ac2e8f

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 639fe88ef085d601	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exe

description pid process

Token: SeShutdownPrivilege 2484 svchost.exe
Token: SeCreatePagefilePrivilege 2484 svchost.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

pidor.bmp.bin.exe

pid process

3684 pidor.bmp.bin.exe
3684 pidor.bmp.bin.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pidor.bmp.bin.exe

pid process

3684 pidor.bmp.bin.exe

C:\Users\Admin\AppData\Local\Temp\pidor.bmp.bin.exe
"C:\Users\Admin\AppData\Local\Temp\pidor.bmp.bin.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2484

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...