Analysis

  • max time kernel
    178s
  • max time network
    186s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    17/02/2022, 00:10

General

  • Target

    81068095a25365160b7228801531362e9dbb7bc11a26d27e0126c9667efabfb4.exe

  • Size

    110KB

  • MD5

    d25f3713c231dc8439fc0bc545a11715

  • SHA1

    a676388d3119b51e1b3e373a9955688d1369847a

  • SHA256

    81068095a25365160b7228801531362e9dbb7bc11a26d27e0126c9667efabfb4

  • SHA512

    3fe19406f3638bb8cb916c0b997f1757ac9c602cb98db77e1abae4d4e47e9729cdbf4babba0ab3bf75b03c3e7794d2104e9978492b2ba6a4fc8bc471d13ab5f6

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 3 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81068095a25365160b7228801531362e9dbb7bc11a26d27e0126c9667efabfb4.exe
    "C:\Users\Admin\AppData\Local\Temp\81068095a25365160b7228801531362e9dbb7bc11a26d27e0126c9667efabfb4.exe"
    1⤵
      PID:1936
    • C:\Windows\system32\MusNotifyIcon.exe
      %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
      1⤵
      • Checks processor information in registry
      PID:4012
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:1404
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:848

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads