998746d0f5d0c13df720f0bf3981d652c828ea64d64d2e16736a80123fb534aa

Analysis

max time kernel
4265058s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
14/01/2022, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39924fd67ad38b45a9f0871798074ec4.exe
Size 435KB
Sample220114-thdr8ahba3
SHA256 998746d0f5d0c13df720f0bf3981d652c828ea64d64d2e16736a80123fb534aa
MD5 39924fd67ad38b45a9f0871798074ec4
SHA1 9d8af43fbfe30f21c5f0e147ddc211efb67e71c6
SHA512 a77d009f8aa88f6cd0bc428219075169b495a16417aa3768e9d5be20635f5dd785dbfe1b7f23cc8b37e841fc4f354ea07157970487d4ec29600f6ca56a697a96
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2352	MusNotification.exe
Token: SeCreatePagefilePrivilege	2352	MusNotification.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 244	2592	39924fd67ad38b45a9f0871798074ec4.exe	53
PID 2592 wrote to memory of 244	2592	39924fd67ad38b45a9f0871798074ec4.exe	53
PID 2592 wrote to memory of 244	2592	39924fd67ad38b45a9f0871798074ec4.exe	53
PID 244 wrote to memory of 3164	244	fondue.exe	54
PID 244 wrote to memory of 3164	244	fondue.exe	54

C:\Users\Admin\AppData\Local\Temp\39924fd67ad38b45a9f0871798074ec4.exe
"C:\Users\Admin\AppData\Local\Temp\39924fd67ad38b45a9f0871798074ec4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:3164

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads