Overview

overview

10

Static

static

9

5a309fcd09...38.exe

windows7_x64

10

5a309fcd09...38.exe

windows10-2004_x64

4

Analysis

  • max time kernel
    121s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    12-02-2022 13:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5a309fcd09092bd21ea6215b470d439d9c2aaf875f70553aa627f4b5b41b3e38.exe

  • Size

    585KB

  • MD5

    46b33a01ddc74f6ed96a3793744eedfd

  • SHA1

    654f6e185b5ab4a0a98c36d8b24d7f6399c8a61a

  • SHA256

    5a309fcd09092bd21ea6215b470d439d9c2aaf875f70553aa627f4b5b41b3e38

  • SHA512

    6635af0047324d7fdc018eb42339dd75b165daeb5ebd468b5fa27ec877b23ee05bd7f540790af2053822d62784cfe6cc5f12b87d0d738289225f4f2d5c903673

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a309fcd09092bd21ea6215b470d439d9c2aaf875f70553aa627f4b5b41b3e38.exe
    "C:\Users\Admin\AppData\Local\Temp\5a309fcd09092bd21ea6215b470d439d9c2aaf875f70553aa627f4b5b41b3e38.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\SysWOW64\fondue.exe
      "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2148
      • C:\Windows\system32\FonDUE.EXE
        "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
        3⤵
          PID:2572
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3660
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4216

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3660-130-0x00000203DE580000-0x00000203DE590000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3660-131-0x00000203DED60000-0x00000203DED70000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3660-132-0x00000203E1960000-0x00000203E1964000-memory.dmp

      Filesize

      16KB

      Download