a47685b867e6b164a812a05f35b6732c9b81f1fc75b2a7242c18436a9329d247 | Triage

Analysis

max time kernel
24s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05-02-2022 11:56

Sharing

Report Analysis Logs

General

Target

a47685b867e6b164a812a05f35b6732c9b81f1fc75b2a7242c18436a9329d247.dll
Size

456KB
MD5

d2d259229212aed1a346b8e0187b7d92
SHA1

84ef96d8c3257db85d7358d50ccbfa3ca5d70828
SHA256

a47685b867e6b164a812a05f35b6732c9b81f1fc75b2a7242c18436a9329d247
SHA512

a1ff26f415f94c331d2c70c54c6b53a5ea5c07f996828733ff9fa3eb04c68d41094152377a2051a7411950ccd48ddfb05364c740ba6fde4edba778f7e10d6ea5

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2184	svchost.exe
Token: SeCreatePagefilePrivilege	2184	svchost.exe
Token: SeShutdownPrivilege	2184	svchost.exe
Token: SeCreatePagefilePrivilege	2184	svchost.exe
Token: SeShutdownPrivilege	2184	svchost.exe
Token: SeCreatePagefilePrivilege	2184	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 2772	4456	rundll32.exe	82
PID 4456 wrote to memory of 2772	4456	rundll32.exe	82
PID 4456 wrote to memory of 2772	4456	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a47685b867e6b164a812a05f35b6732c9b81f1fc75b2a7242c18436a9329d247.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a47685b867e6b164a812a05f35b6732c9b81f1fc75b2a7242c18436a9329d247.dll,#1
  2⤵
  PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-130-0x0000024652FA0000-0x0000024652FB0000-memory.dmp

Filesize
64KB

Download
memory/2184-137-0x0000024655C20000-0x0000024655C24000-memory.dmp

Filesize
16KB

Download