Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    01-02-2022 12:50

General

  • Target

    e46cd935e22dcbb21e8a802f714a28f91ffd53351655f28c1df0b418d6d535b5.exe

  • Size

    16KB

  • MD5

    94bb9374009cc16b51e12d94a968bb22

  • SHA1

    9da912dfe2d17614b2f24e6fcfd20a976ea284c4

  • SHA256

    e46cd935e22dcbb21e8a802f714a28f91ffd53351655f28c1df0b418d6d535b5

  • SHA512

    4ed65bf225191959a62921ec1420a629698b61ca6682c1f9934e748032609e8fd37bd34af3fbabc0b0545745b8f3bbced73e26ef97b2e7a2cecd624714ee39f7

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e46cd935e22dcbb21e8a802f714a28f91ffd53351655f28c1df0b418d6d535b5.exe
    "C:\Users\Admin\AppData\Local\Temp\e46cd935e22dcbb21e8a802f714a28f91ffd53351655f28c1df0b418d6d535b5.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Windows\system32\fondue.exe
      "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
      2⤵
        PID:2380
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1720

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads