Analysis

  • max time kernel
    5s
  • max time network
    69s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    11-05-2021 09:42

General

  • Target

    1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe

  • Size

    98KB

  • MD5

    ea01dcd803b0b6de2878f1486d532f6e

  • SHA1

    581e56a7e8a44441a52707445929513a2f994591

  • SHA256

    1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e

  • SHA512

    59631ee3a3c95964619dcce1f2110979045e363630f639ac96fd47fa3f24b0965c3ed224682bfea8ea43bb0566c3eef0eb330f06c80027ff8e96ba25a9597d53

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
    "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
    1⤵
      PID:3256
    • C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      1⤵
        PID:3792
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 3792 -s 848
          2⤵
          • Program crash
          PID:3412
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
          PID:3472
        • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
          1⤵
            PID:3276
          • C:\Windows\Explorer.EXE
            C:\Windows\Explorer.EXE
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2492
            • C:\Users\Admin\AppData\Local\Temp\1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
              "C:\Users\Admin\AppData\Local\Temp\1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe"
              2⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4048
              • C:\Users\Admin\AppData\Local\Temp\1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
                C:\Users\Admin\AppData\Local\Temp\1da0c9939d5c1f82c0865ef539a7fdbcba33a40e964b47fbfb582a52eab4e61e.exe
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2252
                • C:\Windows\SysWOW64\winver.exe
                  winver
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:2388
          • c:\windows\system32\taskhostw.exe
            taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
            1⤵
              PID:2964
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
              1⤵
                PID:2880
              • c:\windows\system32\sihost.exe
                sihost.exe
                1⤵
                  PID:2844
                • C:\Windows\system32\DllHost.exe
                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                  1⤵
                    PID:1836

                  Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/1836-144-0x000001D6FF5F0000-0x000001D6FF600000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-143-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-153-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-133-0x000001D6FF1A0000-0x000001D6FF1B0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-151-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-147-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-150-0x000001D6FF5F0000-0x000001D6FF600000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-149-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-132-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-148-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-146-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-145-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-142-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-134-0x00007FFDE2900000-0x00007FFDE2901000-memory.dmp

                    Filesize

                    4KB

                  • memory/1836-128-0x0000000000EE0000-0x0000000000EE6000-memory.dmp

                    Filesize

                    24KB

                  • memory/1836-130-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-131-0x000001D6FF670000-0x000001D6FF680000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-129-0x000001D6FF670000-0x000001D6FF680000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-138-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-152-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-139-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-135-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-137-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/1836-136-0x000001D6FF200000-0x000001D6FF210000-memory.dmp

                    Filesize

                    64KB

                  • memory/2252-114-0x0000000000400000-0x000000000149A000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2252-118-0x0000000000400000-0x0000000000404400-memory.dmp

                    Filesize

                    17KB

                  • memory/2252-119-0x0000000001880000-0x0000000002280000-memory.dmp

                    Filesize

                    10.0MB

                  • memory/2252-115-0x0000000000401000-mapping.dmp

                  • memory/2388-120-0x00000000032B0000-0x00000000032B6000-memory.dmp

                    Filesize

                    24KB

                  • memory/2388-116-0x0000000000000000-mapping.dmp

                  • memory/2492-122-0x00007FFDE2900000-0x00007FFDE2901000-memory.dmp

                    Filesize

                    4KB

                  • memory/2492-123-0x00000000014C0000-0x00000000014C6000-memory.dmp

                    Filesize

                    24KB

                  • memory/2492-121-0x00000000014B0000-0x00000000014B6000-memory.dmp

                    Filesize

                    24KB

                  • memory/2844-124-0x00000000004D0000-0x00000000004D6000-memory.dmp

                    Filesize

                    24KB

                  • memory/2880-125-0x0000000000640000-0x0000000000646000-memory.dmp

                    Filesize

                    24KB

                  • memory/2964-126-0x0000000000D90000-0x0000000000D96000-memory.dmp

                    Filesize

                    24KB

                  • memory/3472-127-0x0000000000C40000-0x0000000000C46000-memory.dmp

                    Filesize

                    24KB

                  • memory/4048-117-0x0000000000870000-0x0000000000874000-memory.dmp

                    Filesize

                    16KB