Analysis
- max time kernel
161s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
13/02/2022, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
b132047de31cdc2d9bb9ee47bd020642.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b132047de31cdc2d9bb9ee47bd020642.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target b132047de31cdc2d9bb9ee47bd020642.exe
- Size 8.9MB
- Sample220213-pclteshfg4
- SHA256 63e36995cd07fc718f4dbdc4fbec99b24073568df86e3385bcd49e0c1e24c917
- MD5 b132047de31cdc2d9bb9ee47bd020642
- SHA1 9505dee76ffba481b85aa73dae0473f8bc269d32
- SHA512 c7ebb0b8211b49e684079be7a32f6b9743050721770732d1e1622c0d7eb9746314ca42eb90eccaf7fc825a3703b9092883c7675b4978939789dfcdbf68a99e82
- MD5 SHA1 SHA512
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Modifies data under HKEY_USERS 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4124" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.898888" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4300" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132894043894328757" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "8.823506" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe 832 b132047de31cdc2d9bb9ee47bd020642.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 832 b132047de31cdc2d9bb9ee47bd020642.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 832 b132047de31cdc2d9bb9ee47bd020642.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 832 b132047de31cdc2d9bb9ee47bd020642.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b132047de31cdc2d9bb9ee47bd020642.exe"C:\Users\Admin\AppData\Local\Temp\b132047de31cdc2d9bb9ee47bd020642.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:832
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:1348
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:480
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1592