0dbd6d9cc6b7556f14ebc05f8c9346605a18da53d0262230807b4ad7738c8e62 | Triage

Analysis

max time kernel
14s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
05-02-2022 19:33

Sharing

Report Analysis Logs

General

Target

0dbd6d9cc6b7556f14ebc05f8c9346605a18da53d0262230807b4ad7738c8e62.exe
Size

2.0MB
MD5

f04258cfed1c15f32770bb0cd40a94a2
SHA1

33a8df629ccf3392c615d76e0b9ce12517ae597b
SHA256

0dbd6d9cc6b7556f14ebc05f8c9346605a18da53d0262230807b4ad7738c8e62
SHA512

a88be500b00842673ebcb22fc7048866e9d7d537d40a8c5ca2a82db2cdf357c3e38f97247a645914e3d59a2b4986813417b2ebc9343c755b00ffcf77ff2bda9e

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	3896	svchost.exe
Token: SeCreatePagefilePrivilege	3896	svchost.exe
Token: SeShutdownPrivilege	3896	svchost.exe
Token: SeCreatePagefilePrivilege	3896	svchost.exe
Token: SeShutdownPrivilege	3896	svchost.exe
Token: SeCreatePagefilePrivilege	3896	svchost.exe

C:\Users\Admin\AppData\Local\Temp\0dbd6d9cc6b7556f14ebc05f8c9346605a18da53d0262230807b4ad7738c8e62.exe
"C:\Users\Admin\AppData\Local\Temp\0dbd6d9cc6b7556f14ebc05f8c9346605a18da53d0262230807b4ad7738c8e62.exe"
1⤵
PID:4040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3896-136-0x0000028A46EE0000-0x0000028A46EF0000-memory.dmp

Filesize
64KB

Download
memory/3896-137-0x0000028A493A0000-0x0000028A493A4000-memory.dmp

Filesize
16KB

Download