a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10 | Triage

Analysis

max time kernel
47s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20-02-2022 03:52

Sharing

Report Analysis Logs

General

Target

a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe
Size

202KB
MD5

fd1f7a77ea9efd1f2e291c031f441c74
SHA1

c5fdb9dc74560446c9404e01ce176b02899e89e4
SHA256

a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10
SHA512

b4d93fbde71c50f62bedd5ff4d1c81ad7e925ea4bed0df3bf562cdf97b60691ae6d668f9f45615de5eaf8ef2e28dea9a28b197146857223b3d2d9a0c9d436282

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe
4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe
4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe
4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2896	4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe	51
PID 4816 wrote to memory of 2916	4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe	23
PID 4816 wrote to memory of 2956	4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe	50
PID 4816 wrote to memory of 3008	4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe	48
PID 4816 wrote to memory of 3260	4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe	24

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2916

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3008

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2956

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2896

C:\Users\Admin\AppData\Local\Temp\a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe
"C:\Users\Admin\AppData\Local\Temp\a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2896-130-0x00007FF7F03F0000-0x00007FF7F06CA000-memory.dmp

Filesize
2.9MB

Download
memory/2916-131-0x00007FF7F03F0000-0x00007FF7F06CA000-memory.dmp

Filesize
2.9MB

Download