Analysis
-
max time kernel
143s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
10-02-2022 21:59
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
speco_plugin.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
speco_plugin.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
system.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
system.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
1.exe
-
Size
19.4MB
-
MD5
6a58b52b184715583cda792b56a0a1ed
-
SHA1
3477a173e2c1005a81d042802ab0f22cc12a4d55
-
SHA256
d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb
-
SHA512
49ee746a98bce076cd20a36d57d08ed0dc39d48a0a2866173d4c0dbb1633e2ec8e069f4dbba578e707c8dd1de1fcc908cf412e4a9fff9ecc78ac92357e75c313
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 5072 1.tmp -
Loads dropped DLL 1 IoCs
pid Process 5072 1.tmp -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3032 svchost.exe Token: SeCreatePagefilePrivilege 3032 svchost.exe Token: SeShutdownPrivilege 3032 svchost.exe Token: SeCreatePagefilePrivilege 3032 svchost.exe Token: SeShutdownPrivilege 3032 svchost.exe Token: SeCreatePagefilePrivilege 3032 svchost.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe Token: SeRestorePrivilege 3172 TiWorker.exe Token: SeSecurityPrivilege 3172 TiWorker.exe Token: SeBackupPrivilege 3172 TiWorker.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2772 wrote to memory of 5072 2772 1.exe 81 PID 2772 wrote to memory of 5072 2772 1.exe 81 PID 2772 wrote to memory of 5072 2772 1.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\is-DS4P3.tmp\1.tmp"C:\Users\Admin\AppData\Local\Temp\is-DS4P3.tmp\1.tmp" /SL5="$2011A,19769177,139776,C:\Users\Admin\AppData\Local\Temp\1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5072
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3172