a564910112b33b769485254ae891a16cbb5b91ad5a099408e290658698edc81a | Triage™

Analysis

max time kernel
130s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05/02/2022, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a564910112b33b769485254ae891a16cbb5b91ad5a099408e290658698edc81a.exe
Size 268KB
Sample220205-n2bjbabcdl
SHA256 a564910112b33b769485254ae891a16cbb5b91ad5a099408e290658698edc81a
MD5 1d94cc32838b73795b6578564b80905a
SHA1 efebe3b5f72975a95d86d31f0bc83f50815cc013
SHA512 ffe09f26feb1193bb5a656bd8cf6c269b0d0eadb099239ddef64ea927ad80012d9395afe5cca0b64f065f3a84901acaa1799adb33718bb2716c3ba59b79e631e
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2392	svchost.exe
Token: SeCreatePagefilePrivilege	2392	svchost.exe
Token: SeShutdownPrivilege	2392	svchost.exe
Token: SeCreatePagefilePrivilege	2392	svchost.exe
Token: SeShutdownPrivilege	2392	svchost.exe
Token: SeCreatePagefilePrivilege	2392	svchost.exe

C:\Users\Admin\AppData\Local\Temp\a564910112b33b769485254ae891a16cbb5b91ad5a099408e290658698edc81a.exe
"C:\Users\Admin\AppData\Local\Temp\a564910112b33b769485254ae891a16cbb5b91ad5a099408e290658698edc81a.exe"
1⤵
PID:2084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2392-143-0x00000163E5DC0000-0x00000163E5DC4000-memory.dmp

Download