5b41d194193aff5d738663061e42fb95e2af7d25c60855f447f4bc3c8cd07089 | Triage™

Analysis

max time kernel
153s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
06/02/2022, 12:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b41d194193aff5d738663061e42fb95e2af7d25c60855f447f4bc3c8cd07089.exe
Size 172KB
Sample220206-n8pphsaab6
SHA256 5b41d194193aff5d738663061e42fb95e2af7d25c60855f447f4bc3c8cd07089
MD5 eaa326d91058e7966e9350fcf9e85f68
SHA1 11117c44736f0d1f52c848e8a30fad75eb78e5bc
SHA512 1edec6432230ecb54994d54e6fada6da8c24b1ba626923853263711abe428aa6649e6bca02b80b49e335ab8e5f5bb75c166d1ddfa558deb8560793d1a9a095be
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4068	svchost.exe
Token: SeCreatePagefilePrivilege	4068	svchost.exe
Token: SeShutdownPrivilege	4068	svchost.exe
Token: SeCreatePagefilePrivilege	4068	svchost.exe
Token: SeShutdownPrivilege	4068	svchost.exe
Token: SeCreatePagefilePrivilege	4068	svchost.exe

C:\Users\Admin\AppData\Local\Temp\5b41d194193aff5d738663061e42fb95e2af7d25c60855f447f4bc3c8cd07089.exe
"C:\Users\Admin\AppData\Local\Temp\5b41d194193aff5d738663061e42fb95e2af7d25c60855f447f4bc3c8cd07089.exe"
1⤵
PID:2084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4068-142-0x000001A41CFC0000-0x000001A41CFC4000-memory.dmp

Download