a3144445ce624cfeed2b1979b86b06a9158abf23ab4fa1bc469faa09513e6392 | Triage

Analysis

max time kernel
129s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05-02-2022 12:01

Sharing

Report Analysis Logs

General

Target

ORDER LIST.exe
Size

553KB
MD5

66229de31ea90fd52b48ab37e6f4caf3
SHA1

e2d6285978cbaf9586cdd3dd651a7547151ab323
SHA256

b59902c78b8de40c1537046c0dfe7aa048edb116bec0b8746cef3718e69943f8
SHA512

b26d3cdfea9c90910c80107838050cf1db610d3e6fe73737353b8fd19ffa8eaa9b7b251e25ee168334a3e1d6490b4b862f93a6055ad07cfbcf594b578ad511d9

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	3696	svchost.exe
Token: SeCreatePagefilePrivilege	3696	svchost.exe
Token: SeShutdownPrivilege	3696	svchost.exe
Token: SeCreatePagefilePrivilege	3696	svchost.exe
Token: SeShutdownPrivilege	3696	svchost.exe
Token: SeCreatePagefilePrivilege	3696	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

ORDER LIST.exefondue.exe

description	pid	process	target process
PID 4060 wrote to memory of 4088	4060	ORDER LIST.exe	fondue.exe
PID 4060 wrote to memory of 4088	4060	ORDER LIST.exe	fondue.exe
PID 4060 wrote to memory of 4088	4060	ORDER LIST.exe	fondue.exe
PID 4088 wrote to memory of 4980	4088	fondue.exe	FonDUE.EXE
PID 4088 wrote to memory of 4980	4088	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\ORDER LIST.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER LIST.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4060

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4088

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:4980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3696-130-0x00000290A3980000-0x00000290A3990000-memory.dmp

Filesize
64KB

Download
memory/3696-137-0x00000290A6700000-0x00000290A6704000-memory.dmp

Filesize
16KB

Download