df3d947eb72a7b10f90222ae5a0aab0aade66f0bc1d3812c1b0366e6e8456591 | Triage

Analysis

max time kernel
31s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20/02/2022, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

df3d947eb72a7b10f90222ae5a0aab0aade66f0bc1d3812c1b0366e6e8456591.exe
Size

208KB
MD5

b73d6af47bd63b87953279100d7baa00
SHA1

6797dbc139b45701dba1f9d13230935eb1c4f187
SHA256

df3d947eb72a7b10f90222ae5a0aab0aade66f0bc1d3812c1b0366e6e8456591
SHA512

f87f8b6488309c0ac199df40bdc4b740f0a20ba6488a8cb980b00b5f2599fdab3b233e0d97d1c9db6c1563929e8ee6a28cc0d032d2458cbce4f102826cc77b0e

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5108	df3d947eb72a7b10f90222ae5a0aab0aade66f0bc1d3812c1b0366e6e8456591.exe
5108	df3d947eb72a7b10f90222ae5a0aab0aade66f0bc1d3812c1b0366e6e8456591.exe
5108	df3d947eb72a7b10f90222ae5a0aab0aade66f0bc1d3812c1b0366e6e8456591.exe
5108	df3d947eb72a7b10f90222ae5a0aab0aade66f0bc1d3812c1b0366e6e8456591.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5108	df3d947eb72a7b10f90222ae5a0aab0aade66f0bc1d3812c1b0366e6e8456591.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 2284	5108	df3d947eb72a7b10f90222ae5a0aab0aade66f0bc1d3812c1b0366e6e8456591.exe	60
PID 5108 wrote to memory of 2304	5108	df3d947eb72a7b10f90222ae5a0aab0aade66f0bc1d3812c1b0366e6e8456591.exe	24
PID 5108 wrote to memory of 2404	5108	df3d947eb72a7b10f90222ae5a0aab0aade66f0bc1d3812c1b0366e6e8456591.exe	59
PID 5108 wrote to memory of 3132	5108	df3d947eb72a7b10f90222ae5a0aab0aade66f0bc1d3812c1b0366e6e8456591.exe	50
PID 5108 wrote to memory of 3332	5108	df3d947eb72a7b10f90222ae5a0aab0aade66f0bc1d3812c1b0366e6e8456591.exe	27

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2304

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3132

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2404

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2284

C:\Users\Admin\AppData\Local\Temp\df3d947eb72a7b10f90222ae5a0aab0aade66f0bc1d3812c1b0366e6e8456591.exe
"C:\Users\Admin\AppData\Local\Temp\df3d947eb72a7b10f90222ae5a0aab0aade66f0bc1d3812c1b0366e6e8456591.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2284-130-0x00007FF7C6140000-0x00007FF7C641C000-memory.dmp

Filesize
2.9MB

Download
memory/2304-131-0x00007FF7C6140000-0x00007FF7C641C000-memory.dmp

Filesize
2.9MB

Download