b29b726983a48a3f23a92799ff7ade79b1b9baed03a4bfed904f64c8cf2c17cd | Triage

Analysis

max time kernel
135s
max time network
139s
platform
windows7_x64
resource
win7v20201028
submitted
04-03-2021 18:20

Sharing

Report Analysis Logs

General

Target

f129c6db_extracted.exe
Size

154KB
MD5

bfdac41f9d0c9f2e566c6792393578e4
SHA1

dedecc4d3bd586e7b43822291be3f2a801a51e79
SHA256

b29b726983a48a3f23a92799ff7ade79b1b9baed03a4bfed904f64c8cf2c17cd
SHA512

efc77bd7a85e047f579d108925cc5f04d49be53202c66b248768ac06a99ce658cd3c3631c2ab0ccda9233ab10107c506490ae1e1a41608192602a0d74bd1cffa

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2036 taskkill.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f129c6db_extracted.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 528 f129c6db_extracted.exe
Token: SeDebugPrivilege 2036 taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

f129c6db_extracted.execmd.exe

description	pid	process	target process
PID 528 wrote to memory of 2040	528	f129c6db_extracted.exe	cmd.exe
PID 528 wrote to memory of 2040	528	f129c6db_extracted.exe	cmd.exe
PID 528 wrote to memory of 2040	528	f129c6db_extracted.exe	cmd.exe
PID 528 wrote to memory of 2040	528	f129c6db_extracted.exe	cmd.exe
PID 2040 wrote to memory of 2036	2040	cmd.exe	taskkill.exe
PID 2040 wrote to memory of 2036	2040	cmd.exe	taskkill.exe
PID 2040 wrote to memory of 2036	2040	cmd.exe	taskkill.exe
PID 2040 wrote to memory of 2036	2040	cmd.exe	taskkill.exe
PID 2040 wrote to memory of 1900	2040	cmd.exe	choice.exe
PID 2040 wrote to memory of 1900	2040	cmd.exe	choice.exe
PID 2040 wrote to memory of 1900	2040	cmd.exe	choice.exe
PID 2040 wrote to memory of 1900	2040	cmd.exe	choice.exe

C:\Users\Admin\AppData\Local\Temp\f129c6db_extracted.exe
"C:\Users\Admin\AppData\Local\Temp\f129c6db_extracted.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 528 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\f129c6db_extracted.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /PID 528
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:1900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/528-2-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/528-3-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/528-5-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/1900-8-0x0000000000000000-mapping.dmp

Download
memory/2036-7-0x0000000000000000-mapping.dmp

Download
memory/2040-6-0x0000000000000000-mapping.dmp

Download