4723ab5ed01fb642eb602ff59309d4d698e6011145ca1b757bb223b5a67fe159 | Triage

Analysis

max time kernel
34s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05-02-2022 16:17

Sharing

Report Analysis Logs

General

Target

4723ab5ed01fb642eb602ff59309d4d698e6011145ca1b757bb223b5a67fe159.exe
Size

2.2MB
MD5

79d702974c9b1588b1ad025fafad4d0a
SHA1

88de570baf2c2a3fcb74c952669e9867706c343f
SHA256

4723ab5ed01fb642eb602ff59309d4d698e6011145ca1b757bb223b5a67fe159
SHA512

4970fe0e9849d0f0f7dd2201d20d1345deb53a686b18304c0e16af96b369964bb79e89b3bcd84c47eb30ad0a93777ad3d66842e77bcdb80b98df3cfaba0e0f12

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2296	svchost.exe
Token: SeCreatePagefilePrivilege	2296	svchost.exe
Token: SeShutdownPrivilege	2296	svchost.exe
Token: SeCreatePagefilePrivilege	2296	svchost.exe
Token: SeShutdownPrivilege	2296	svchost.exe
Token: SeCreatePagefilePrivilege	2296	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4636	4723ab5ed01fb642eb602ff59309d4d698e6011145ca1b757bb223b5a67fe159.exe

C:\Users\Admin\AppData\Local\Temp\4723ab5ed01fb642eb602ff59309d4d698e6011145ca1b757bb223b5a67fe159.exe
"C:\Users\Admin\AppData\Local\Temp\4723ab5ed01fb642eb602ff59309d4d698e6011145ca1b757bb223b5a67fe159.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-130-0x00000219E2390000-0x00000219E23A0000-memory.dmp

Filesize
64KB

Download
memory/2296-137-0x00000219E5010000-0x00000219E5014000-memory.dmp

Filesize
16KB

Download