cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d | Triage

Analysis

max time kernel
51s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20-02-2022 01:50

Sharing

Report Analysis Logs

General

Target

cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d.exe
Size

209KB
MD5

a48d9d97ed4698432823d5fbc4426e35
SHA1

77b6c5b3c3890ad324743367e37da8a35882fde2
SHA256

cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d
SHA512

1baadbbb701db4f75f40adae0da76ccd9ee4b20c82697cfaef3e34f20b9142f1ff90edbc96984c0de8e99baec63ec378730fa4fd0765b931cb4242bd79862521

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1068	cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d.exe
1068	cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d.exe
1068	cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d.exe
1068	cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2280	1068	cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d.exe	36
PID 1068 wrote to memory of 2336	1068	cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d.exe	73
PID 1068 wrote to memory of 2460	1068	cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d.exe	44
PID 1068 wrote to memory of 508	1068	cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d.exe	71
PID 1068 wrote to memory of 3272	1068	cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d.exe	49

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2280

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2460

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2336

C:\Users\Admin\AppData\Local\Temp\cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d.exe
"C:\Users\Admin\AppData\Local\Temp\cf2e3265c9a05b2616ebc53a6f9ed7e8fc188ba15834295bb16f68c48de65b7d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-130-0x00007FF7367F0000-0x00007FF736B87000-memory.dmp

Filesize
3.6MB

Download
memory/2336-131-0x00007FF7367F0000-0x00007FF736B87000-memory.dmp

Filesize
3.6MB

Download