61952a62e8f822a8dba47bf707d2c9e327657a3e8e2047f9db5fb3479e6be42c | Triage™

Analysis

max time kernel
127s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
19/01/2022, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TCukZcOa.dll
Size 602KB
Sample220119-ws7jdscbgj
SHA256 61952a62e8f822a8dba47bf707d2c9e327657a3e8e2047f9db5fb3479e6be42c
MD5 06a38be7baeae8b4124d3eee9dc76b1a
SHA1 d5be943a3b5204f00953e393d65d2df958222124
SHA512 193b9be9f0706f670f5a1dc2400f36689922f22d55ef3261ea8437019314c861a24edf67fdeebcb498756388330731ec5e6bfa38b3b2b50074bf861c37606729
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	916	svchost.exe
Token: SeSystemtimePrivilege	916	svchost.exe
Token: SeIncBasePriorityPrivilege	916	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 896	816	regsvr32.exe	52
PID 816 wrote to memory of 896	816	regsvr32.exe	52
PID 816 wrote to memory of 896	816	regsvr32.exe	52
PID 896 wrote to memory of 1896	896	regsvr32.exe	54
PID 896 wrote to memory of 1896	896	regsvr32.exe	54
PID 896 wrote to memory of 1896	896	regsvr32.exe	54

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\TCukZcOa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\TCukZcOa.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\TCukZcOa.dll",DllRegisterServer
    3⤵
    PID:1896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads