Overview

overview

7

Static

static

7

601ec8490f...91.exe

windows7_x64

1

601ec8490f...91.exe

windows10-2004_x64

4

Analysis

  • max time kernel
    133s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    15-02-2022 12:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    601ec8490fe25f403517a40f67a2139f73941f02db975ce46bb7d854de138c91.exe

  • Size

    3.9MB

  • MD5

    a0997befa0affdaa594f96d2dee0b10a

  • SHA1

    36a70410b06c9fba48c72f279b047674276b4f2f

  • SHA256

    601ec8490fe25f403517a40f67a2139f73941f02db975ce46bb7d854de138c91

  • SHA512

    c87fbe565f04b065ee50f4abd36aed1f0305dbb6c90a161a156a2cfc4dcef410efdcbc0d3699ddd651dce52b3f4b7b77e5cc38a9e14c1559bf0d1880b4f977cc

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\601ec8490fe25f403517a40f67a2139f73941f02db975ce46bb7d854de138c91.exe
    "C:\Users\Admin\AppData\Local\Temp\601ec8490fe25f403517a40f67a2139f73941f02db975ce46bb7d854de138c91.exe"
    1⤵
      PID:3836
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1416
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2292

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1416-130-0x0000013A9E530000-0x0000013A9E540000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1416-131-0x0000013A9E590000-0x0000013A9E5A0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1416-132-0x0000013AA12A0000-0x0000013AA12A4000-memory.dmp
      Filesize

      16KB

      Download