4003903fd0e1cf7141ee3eb3819499755aeebb0532531524b788135f08e5cbe5 | Triage™

Analysis

max time kernel
19s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05/02/2022, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4003903fd0e1cf7141ee3eb3819499755aeebb0532531524b788135f08e5cbe5.exe
Size 532KB
Sample220205-t2fqxsdcd9
SHA256 4003903fd0e1cf7141ee3eb3819499755aeebb0532531524b788135f08e5cbe5
MD5 042fc821397ff8eec083be06c655e0d0
SHA1 d4220332bbc3db372f0aad931b49d4b4d9bb0825
SHA512 ebea0203733d061c8b590ef2614f7486f70fcc831d47a61ae5cf68907e152929d2c040898c08ab13213a3a3924cfbba1a13c1d85ec5d3548265bd32d7d57dcad
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4320	svchost.exe
Token: SeCreatePagefilePrivilege	4320	svchost.exe
Token: SeShutdownPrivilege	4320	svchost.exe
Token: SeCreatePagefilePrivilege	4320	svchost.exe
Token: SeShutdownPrivilege	4320	svchost.exe
Token: SeCreatePagefilePrivilege	4320	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3480	4003903fd0e1cf7141ee3eb3819499755aeebb0532531524b788135f08e5cbe5.exe

C:\Users\Admin\AppData\Local\Temp\4003903fd0e1cf7141ee3eb3819499755aeebb0532531524b788135f08e5cbe5.exe
"C:\Users\Admin\AppData\Local\Temp\4003903fd0e1cf7141ee3eb3819499755aeebb0532531524b788135f08e5cbe5.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4320-144-0x000001A52B9A0000-0x000001A52B9A4000-memory.dmp

Download