7068a9b1749daed4ee27f076965df1781e1cb9a5d0a4bdc116c7e9f9006adbee | Triage

Analysis

max time kernel
18s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05-02-2022 14:27

Sharing

Report Analysis Logs

General

Target

7068a9b1749daed4ee27f076965df1781e1cb9a5d0a4bdc116c7e9f9006adbee.exe
Size

2.3MB
MD5

7a02ac2bd0ea8a9f20246680e7cca71e
SHA1

f73d578daae66444d17991b25706a2894205e761
SHA256

7068a9b1749daed4ee27f076965df1781e1cb9a5d0a4bdc116c7e9f9006adbee
SHA512

1378ee9023442ffd81f636d851a80f2aebf265dbdd26f0303c4ccf6c6c29789a3689ee424076fed74f5da89163f4a4fcc7b29e9cfe2997dfb64d54fb13ad852e

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	1784	svchost.exe
Token: SeCreatePagefilePrivilege	1784	svchost.exe
Token: SeShutdownPrivilege	1784	svchost.exe
Token: SeCreatePagefilePrivilege	1784	svchost.exe
Token: SeShutdownPrivilege	1784	svchost.exe
Token: SeCreatePagefilePrivilege	1784	svchost.exe

C:\Users\Admin\AppData\Local\Temp\7068a9b1749daed4ee27f076965df1781e1cb9a5d0a4bdc116c7e9f9006adbee.exe
"C:\Users\Admin\AppData\Local\Temp\7068a9b1749daed4ee27f076965df1781e1cb9a5d0a4bdc116c7e9f9006adbee.exe"
1⤵
PID:4524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1784-131-0x000002AA8DFE0000-0x000002AA8DFF0000-memory.dmp

Filesize
64KB

Download
memory/1784-130-0x000002AA8D770000-0x000002AA8D780000-memory.dmp

Filesize
64KB

Download
memory/1784-132-0x000002AA904F0000-0x000002AA904F4000-memory.dmp

Filesize
16KB

Download