9fd802cc98954dfb11a8e53cacee7ed1829b8746e061919dfdebd10924275fde | Triage

Analysis

max time kernel
15s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05-02-2022 12:12

Sharing

Report Analysis Logs

General

Target

9fd802cc98954dfb11a8e53cacee7ed1829b8746e061919dfdebd10924275fde.exe
Size

2.3MB
MD5

112a8486e2ff5c18ba18793019431d54
SHA1

1dac14c185394f16a259583a8076cf3e46bdcc8c
SHA256

9fd802cc98954dfb11a8e53cacee7ed1829b8746e061919dfdebd10924275fde
SHA512

9c40af61404144907421efc90b76f60c86d27c91b2e20504abde15ff783729863e476218cbbb7ffdcb7f4e21ab2b2525f67597ada4afc39187ac3fe891d284b8

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\WindowsUpdate.log svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	5088	svchost.exe
Token: SeCreatePagefilePrivilege	5088	svchost.exe
Token: SeShutdownPrivilege	5088	svchost.exe
Token: SeCreatePagefilePrivilege	5088	svchost.exe

C:\Users\Admin\AppData\Local\Temp\9fd802cc98954dfb11a8e53cacee7ed1829b8746e061919dfdebd10924275fde.exe
"C:\Users\Admin\AppData\Local\Temp\9fd802cc98954dfb11a8e53cacee7ed1829b8746e061919dfdebd10924275fde.exe"
1⤵
PID:4716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5088-130-0x000001A4AD1A0000-0x000001A4AD1B0000-memory.dmp

Filesize
64KB

Download
memory/5088-131-0x000001A4AD8F0000-0x000001A4AD900000-memory.dmp

Filesize
64KB

Download