Analysis

  • max time kernel
    139s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    10-02-2022 16:35

General

  • Target

    putty.exe

  • Size

    1.2MB

  • MD5

    b3bb91ad96f2d4c041861ce59ba6ac73

  • SHA1

    e18c6fd6a0d0d5c124c9ef6972a76c47c28c80a3

  • SHA256

    0581160998be30f79bd9a0925a01b0ebc4cb94265dfa7f8da1e2839bf0f1e426

  • SHA512

    e3a8426d202a8aad79aad5d75549753cf70b9c2c0fa4c9468f03d089eca8e529b56cd8fa16b7be3a4cfc019d43ff458b9dc8a1cae44b6ed75e27f21489a2cbdd

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\putty.exe
    "C:\Users\Admin\AppData\Local\Temp\putty.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    PID:3356
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2648
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2648-130-0x000001553E1A0000-0x000001553E1B0000-memory.dmp

    Filesize

    64KB

  • memory/2648-131-0x000001553E960000-0x000001553E970000-memory.dmp

    Filesize

    64KB

  • memory/2648-132-0x0000015541580000-0x0000015541584000-memory.dmp

    Filesize

    16KB