7932563511a4d65bf92daeed58dc54cd8be9d8d6d603aa4cfd16caab61ebe7c8 | Triage

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
06-02-2022 12:03

Sharing

Report Analysis Logs

General

Target

7932563511a4d65bf92daeed58dc54cd8be9d8d6d603aa4cfd16caab61ebe7c8.exe
Size

131KB
MD5

e0f0e1b8a0305753e15b6778f6b88f6e
SHA1

d93dc5ad4bfe846401da0bf86cfddd4ae15b0c4a
SHA256

7932563511a4d65bf92daeed58dc54cd8be9d8d6d603aa4cfd16caab61ebe7c8
SHA512

d3bf70a40e5d554bdf3f411b534d3ea9d1d5d4bf29b0f808178d893c56425f0bbe46c7d82d93784b650d25d8415b881a4ca014839b4cd2c622a628f18ce6f41f

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3084	svchost.exe
Token: SeCreatePagefilePrivilege	3084	svchost.exe
Token: SeShutdownPrivilege	3084	svchost.exe
Token: SeCreatePagefilePrivilege	3084	svchost.exe
Token: SeShutdownPrivilege	3084	svchost.exe
Token: SeCreatePagefilePrivilege	3084	svchost.exe

C:\Users\Admin\AppData\Local\Temp\7932563511a4d65bf92daeed58dc54cd8be9d8d6d603aa4cfd16caab61ebe7c8.exe
"C:\Users\Admin\AppData\Local\Temp\7932563511a4d65bf92daeed58dc54cd8be9d8d6d603aa4cfd16caab61ebe7c8.exe"
1⤵
PID:4836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3084-142-0x00000193D69C0000-0x00000193D69C4000-memory.dmp

Filesize
16KB

Download