b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a | Triage

Analysis

max time kernel
47s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20-02-2022 03:03

Sharing

Report Analysis Logs

General

Target

b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
Size

207KB
MD5

f2f7bef5ff555a8d94876c33903e3676
SHA1

d54850d80c6ada0c22881048640f911b79ea6d35
SHA256

b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a
SHA512

97d2eedba86483e60073a42fcefa1a6b06abf37a425dd4c2a03e3d11523e213340fbfb2bcc6cd9efd97c5d5cdcbc71b411aeb486df456433e2e5c0e5b1d2efed

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
360	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
360	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
360	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
360	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	360	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 2320	360	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	61
PID 360 wrote to memory of 2328	360	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	60
PID 360 wrote to memory of 2444	360	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	59
PID 360 wrote to memory of 8	360	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	50
PID 360 wrote to memory of 3268	360	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	25

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:8

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2328

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2320

C:\Users\Admin\AppData\Local\Temp\b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
"C:\Users\Admin\AppData\Local\Temp\b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-130-0x00007FF64BAA0000-0x00007FF64BE37000-memory.dmp

Filesize
3.6MB

Download
memory/2328-131-0x00007FF64BAA0000-0x00007FF64BE37000-memory.dmp

Filesize
3.6MB

Download