9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910

General

Target
9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910.exe
Size 378KB
Sample220205-pgaa7abbh8
SHA256 9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910
MD5 d0d25ddde9388ab0feb47b9ec3cb7733
SHA1 de6f89f2c17b229a0068a75bf476720a0724fe18
SHA512 25d76db3137a9ee2b0fd9a4e562a6cb89fba025a787e443f0361580b0d7fdbe43f5ebe99c204103939f01a4fedc2e1182aea90b69d3833d001141280805c386f
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 824 set thread context of 2228	824	9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910.exe	98

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
824	9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910.exe
824	9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910.exe
824	9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	824	9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910.exe
Token: SeShutdownPrivilege	5096	svchost.exe
Token: SeCreatePagefilePrivilege	5096	svchost.exe
Token: SeShutdownPrivilege	5096	svchost.exe
Token: SeCreatePagefilePrivilege	5096	svchost.exe
Token: SeShutdownPrivilege	5096	svchost.exe
Token: SeCreatePagefilePrivilege	5096	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2228	824	9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910.exe	98
PID 824 wrote to memory of 2228	824	9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910.exe	98
PID 824 wrote to memory of 2228	824	9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910.exe	98
PID 824 wrote to memory of 2228	824	9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910.exe	98
PID 824 wrote to memory of 2228	824	9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910.exe	98
PID 824 wrote to memory of 2228	824	9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910.exe	98
PID 824 wrote to memory of 2228	824	9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910.exe	98

C:\Users\Admin\AppData\Local\Temp\9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910.exe
"C:\Users\Admin\AppData\Local\Temp\9e2a002527bd520f50a4844c8381e89a09e3489a239766120d63db503eb97910.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/824-130-0x00000000004F0000-0x0000000000554000-memory.dmp

Download

memory/824-131-0x0000000004DA0000-0x0000000004E06000-memory.dmp

Download

memory/824-132-0x0000000004EB0000-0x0000000004F42000-memory.dmp

Download

memory/824-133-0x0000000005120000-0x00000000052E2000-memory.dmp

Download

memory/824-134-0x0000000004D30000-0x0000000004D52000-memory.dmp

Download

memory/824-135-0x0000000004E10000-0x0000000004E32000-memory.dmp

Download

memory/824-136-0x00000000058A0000-0x0000000005E44000-memory.dmp

Download

memory/824-137-0x00000000052F0000-0x0000000005894000-memory.dmp

Download

memory/824-151-0x0000000005590000-0x00000000055D4000-memory.dmp

Download

memory/2228-152-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/5096-150-0x0000016035B90000-0x0000016035B94000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads