1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e

Analysis

max time kernel
5s
max time network
69s
platform
windows10_x64
resource
win10v20210410
submitted
11-05-2021 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
Size

98KB
MD5

ea01dcd803b0b6de2878f1486d532f6e
SHA1

581e56a7e8a44441a52707445929513a2f994591
SHA256

1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e
SHA512

59631ee3a3c95964619dcce1f2110979045e363630f639ac96fd47fa3f24b0965c3ed224682bfea8ea43bb0566c3eef0eb330f06c80027ff8e96ba25a9597d53

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe

description	pid	process	target process
PID 4048 set thread context of 2252	4048	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3412 3792 WerFault.exe DllHost.exe

pid	pid_target	process	target process
3412	3792	WerFault.exe	DllHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exewinver.exe

pid	process
4048	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
4048	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
2388	winver.exe
2388	winver.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

Explorer.EXE

description	pid	process
Token: SeShutdownPrivilege	2492	Explorer.EXE
Token: SeCreatePagefilePrivilege	2492	Explorer.EXE
Token: SeShutdownPrivilege	2492	Explorer.EXE
Token: SeCreatePagefilePrivilege	2492	Explorer.EXE
Token: SeShutdownPrivilege	2492	Explorer.EXE
Token: SeCreatePagefilePrivilege	2492	Explorer.EXE
Token: SeShutdownPrivilege	2492	Explorer.EXE
Token: SeCreatePagefilePrivilege	2492	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

2388 winver.exe

pid	process
2388	winver.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe

pid	process
4048	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
4048	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exewinver.exe

description	pid	process	target process
PID 4048 wrote to memory of 2252	4048	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
PID 4048 wrote to memory of 2252	4048	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
PID 4048 wrote to memory of 2252	4048	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
PID 4048 wrote to memory of 2252	4048	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
PID 4048 wrote to memory of 2252	4048	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
PID 4048 wrote to memory of 2252	4048	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
PID 4048 wrote to memory of 2252	4048	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
PID 2252 wrote to memory of 2388	2252	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe	winver.exe
PID 2252 wrote to memory of 2388	2252	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe	winver.exe
PID 2252 wrote to memory of 2388	2252	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe	winver.exe
PID 2252 wrote to memory of 2388	2252	1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe	winver.exe
PID 2388 wrote to memory of 2492	2388	winver.exe	Explorer.EXE
PID 2388 wrote to memory of 2844	2388	winver.exe	sihost.exe
PID 2388 wrote to memory of 2880	2388	winver.exe	svchost.exe
PID 2388 wrote to memory of 2964	2388	winver.exe	taskhostw.exe
PID 2388 wrote to memory of 2492	2388	winver.exe	Explorer.EXE
PID 2388 wrote to memory of 3256	2388	winver.exe	ShellExperienceHost.exe
PID 2388 wrote to memory of 3276	2388	winver.exe	SearchUI.exe
PID 2388 wrote to memory of 3472	2388	winver.exe	RuntimeBroker.exe
PID 2388 wrote to memory of 3792	2388	winver.exe	DllHost.exe
PID 2388 wrote to memory of 1836	2388	winver.exe	DllHost.exe

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3256

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3792

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3792 -s 848
2⤵
- Program crash
PID:3412

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3472

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3276

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Users\Admin\AppData\Local\Temp\1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
"C:\Users\Admin\AppData\Local\Temp\1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4048

C:\Users\Admin\AppData\Local\Temp\1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
C:\Users\Admin\AppData\Local\Temp\1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2252

C:\Windows\SysWOW64\winver.exe
winver
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2388

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2964

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2880

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2844

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1836-144-0x000001D6FF5F0000-0x000001D6FF600000-memory.dmp

Filesize
64KB

Download
memory/1836-143-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-153-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-133-0x000001D6FF1A0000-0x000001D6FF1B0000-memory.dmp

Filesize
64KB

Download
memory/1836-151-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-147-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-150-0x000001D6FF5F0000-0x000001D6FF600000-memory.dmp

Filesize
64KB

Download
memory/1836-149-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-132-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-148-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-146-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-145-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-142-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-134-0x00007FFDE2900000-0x00007FFDE2901000-memory.dmp

Filesize
4KB

Download
memory/1836-128-0x0000000000EE0000-0x0000000000EE6000-memory.dmp

Filesize
24KB

Download
memory/1836-130-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-131-0x000001D6FF670000-0x000001D6FF680000-memory.dmp

Filesize
64KB

Download
memory/1836-129-0x000001D6FF670000-0x000001D6FF680000-memory.dmp

Filesize
64KB

Download
memory/1836-138-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-152-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-139-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-135-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-137-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/1836-136-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

Filesize
64KB

Download
memory/2252-114-0x0000000000400000-0x000000000149A000-memory.dmp

Filesize
16.6MB

Download
memory/2252-118-0x0000000000400000-0x0000000000404400-memory.dmp

Filesize
17KB

Download
memory/2252-119-0x0000000001880000-0x0000000002280000-memory.dmp

Filesize
10.0MB

Download
memory/2252-115-0x0000000000401000-mapping.dmp

Download
memory/2388-120-0x00000000032B0000-0x00000000032B6000-memory.dmp

Filesize
24KB

Download
memory/2388-116-0x0000000000000000-mapping.dmp

Download
memory/2492-122-0x00007FFDE2900000-0x00007FFDE2901000-memory.dmp

Filesize
4KB

Download
memory/2492-123-0x00000000014C0000-0x00000000014C6000-memory.dmp

Filesize
24KB

Download
memory/2492-121-0x00000000014B0000-0x00000000014B6000-memory.dmp

Filesize
24KB

Download
memory/2844-124-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2880-125-0x0000000000640000-0x0000000000646000-memory.dmp

Filesize
24KB

Download
memory/2964-126-0x0000000000D90000-0x0000000000D96000-memory.dmp

Filesize
24KB

Download
memory/3472-127-0x0000000000C40000-0x0000000000C46000-memory.dmp

Filesize
24KB

Download
memory/4048-117-0x0000000000870000-0x0000000000874000-memory.dmp

Filesize
16KB

Download