69fc2c605ffc41b7d121426cc8a48421aa0f04915331d491cef3ad48b78cc3fa | Triage

Analysis

max time kernel
13s
max time network
118s
platform
windows10_x64
resource
win10v20201028
submitted
15/03/2021, 09:51

Sharing

Report Analysis Logs

General

Target

4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
Size

156KB
MD5

11c9115ed7a92a5496cec4e240cd5dda
SHA1

bfdc6d0e75ac80c8aaf3b6746e74feef158e1b63
SHA256

4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5
SHA512

359c126066052fb3c21129dc22b105a6a29cfa9bd4c903da9a31cb5bdafab5f2cfdcdc6f1dac679e8333b82aaadcf0f5776a1979d0f2be277abbfaac06c87aaf

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Desktop\desktop.ini	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
File opened for modification	C:\Users\Public\desktop.ini	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe

Kills process with taskkill 1 IoCs

pid	Process
1736	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
984	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
984	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1736	984	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe	74
PID 984 wrote to memory of 1736	984	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe	74
PID 984 wrote to memory of 1736	984	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe	74

C:\Users\Admin\AppData\Local\Temp\4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
"C:\Users\Admin\AppData\Local\Temp\4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /PID 984
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads