ac702710c101cdec8102876011a51093dc4030f7646a1c3998a7d5fdac3fb85c | Triage

Analysis

max time kernel
8s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05-02-2022 11:26

Sharing

Report Analysis Logs

General

Target

ac702710c101cdec8102876011a51093dc4030f7646a1c3998a7d5fdac3fb85c.exe
Size

1.9MB
MD5

ed46ef15f2f84d7305a62549f896a47b
SHA1

ea11240893579c0a6e2277d160f746babc3f3a55
SHA256

ac702710c101cdec8102876011a51093dc4030f7646a1c3998a7d5fdac3fb85c
SHA512

f4d19c7cfae6a46050277dc4a22892f4f102a2031512c43a4c2b84b3b5c424588fb7d7af3bbed9cb33b57fee16e501366242912957f41a553c07a524d912295c

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	1368	svchost.exe
Token: SeCreatePagefilePrivilege	1368	svchost.exe
Token: SeShutdownPrivilege	1368	svchost.exe
Token: SeCreatePagefilePrivilege	1368	svchost.exe
Token: SeShutdownPrivilege	1368	svchost.exe
Token: SeCreatePagefilePrivilege	1368	svchost.exe

C:\Users\Admin\AppData\Local\Temp\ac702710c101cdec8102876011a51093dc4030f7646a1c3998a7d5fdac3fb85c.exe
"C:\Users\Admin\AppData\Local\Temp\ac702710c101cdec8102876011a51093dc4030f7646a1c3998a7d5fdac3fb85c.exe"
1⤵
PID:3112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-142-0x0000026B16540000-0x0000026B16544000-memory.dmp

Filesize
16KB

Download