Overview

overview

10

Static

static

0427ebb4d2...12.exe

windows7_x64

10

0427ebb4d2...12.exe

windows10-2004_x64

4

Analysis

  • max time kernel
    149s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    12-02-2022 13:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0427ebb4d26dfc456351aab28040a244c883077145b7b529b93621636663a812.exe

  • Size

    400KB

  • MD5

    745c6cca074429ad3acb076ed3e44a09

  • SHA1

    8d0bfb0026505e551a1d9e7409d01f42e7c8bf40

  • SHA256

    0427ebb4d26dfc456351aab28040a244c883077145b7b529b93621636663a812

  • SHA512

    c165e113886e3e4d2f477cd1ee5f9049ed74806f30b33511873703e31b6a4034cfe2af20cb87f693e80541c74fe726bace69e1179fc88f29acb721671955f8d0

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0427ebb4d26dfc456351aab28040a244c883077145b7b529b93621636663a812.exe
    "C:\Users\Admin\AppData\Local\Temp\0427ebb4d26dfc456351aab28040a244c883077145b7b529b93621636663a812.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Windows\SysWOW64\fondue.exe
      "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3268
      • C:\Windows\system32\FonDUE.EXE
        "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
        3⤵
          PID:4876
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3740
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4592

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3740-130-0x000001F66E420000-0x000001F66E430000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3740-131-0x000001F66E480000-0x000001F66E490000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3740-132-0x000001F670B40000-0x000001F670B44000-memory.dmp

      Filesize

      16KB

      Download