8faef49d64b36052e6648a0426fb2f71af70d9b434be548841a4707fada2410a | Triage™

Analysis

max time kernel
146s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05/02/2022, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8faef49d64b36052e6648a0426fb2f71af70d9b434be548841a4707fada2410a.exe
Size 137KB
Sample220205-p5wt4abgcl
SHA256 8faef49d64b36052e6648a0426fb2f71af70d9b434be548841a4707fada2410a
MD5 d268e5ccab3b71001ad2aa5ac14811da
SHA1 c297a92e980b9f333435d3656c89ef2debe46c83
SHA512 8479d2db4d6252c3002be8099f24004963e400348d08ef2f65a842a41eed6097e83ab46546930a62251d074357aa65938405521b2b89ac81065df39c1e04dd88
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4064	svchost.exe
Token: SeCreatePagefilePrivilege	4064	svchost.exe
Token: SeShutdownPrivilege	4064	svchost.exe
Token: SeCreatePagefilePrivilege	4064	svchost.exe
Token: SeShutdownPrivilege	4064	svchost.exe
Token: SeCreatePagefilePrivilege	4064	svchost.exe

C:\Users\Admin\AppData\Local\Temp\8faef49d64b36052e6648a0426fb2f71af70d9b434be548841a4707fada2410a.exe
"C:\Users\Admin\AppData\Local\Temp\8faef49d64b36052e6648a0426fb2f71af70d9b434be548841a4707fada2410a.exe"
1⤵
PID:3112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3112-143-0x0000000000750000-0x000000000077B000-memory.dmp

Download

memory/4064-142-0x0000024C33240000-0x0000024C33244000-memory.dmp

Download