3317bb0f6350fcafa46c50971b15f4904bfa1e7eca3ad1d01dfce96b6a3be699 | Triage™

Analysis

max time kernel
71s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
07/02/2022, 13:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3317bb0f6350fcafa46c50971b15f4904bfa1e7eca3ad1d01dfce96b6a3be699.dll
Size 607KB
Sample220207-qezzhacea3
SHA256 3317bb0f6350fcafa46c50971b15f4904bfa1e7eca3ad1d01dfce96b6a3be699
MD5 974e849606f49bc265eb817ba3324231
SHA1 a085020631e4c3cc6110f5bf9845a55439daa075
SHA512 9bb0da9b58c78f6dc47477872f20329c558feb824214a51b7b6df0fe43d1fbc1c5b152941116913c315d56b64e45749c477e1acbf98147fbb2c08c27bcca3a19
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1104	svchost.exe
Token: SeCreatePagefilePrivilege	1104	svchost.exe
Token: SeShutdownPrivilege	1104	svchost.exe
Token: SeCreatePagefilePrivilege	1104	svchost.exe
Token: SeShutdownPrivilege	1104	svchost.exe
Token: SeCreatePagefilePrivilege	1104	svchost.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3317bb0f6350fcafa46c50971b15f4904bfa1e7eca3ad1d01dfce96b6a3be699.dll
1⤵
PID:2916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-142-0x00000232E5DC0000-0x00000232E5DC4000-memory.dmp

Download