75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1 | Triage

Analysis

max time kernel
64s
max time network
86s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20/02/2022, 05:40

Sharing

Report Analysis Logs

General

Target

75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe
Size

209KB
MD5

4d409f1fc90b86f5893a8ad63d0d4b84
SHA1

4c7a52b0def17ab668c2bc0dbfa43d56360d0786
SHA256

75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1
SHA512

fdfc68a0d4cc76b38ddede9c2b3fd55719554aff48e73ff3c4e4d0a35ac6b0436501a8e3e9e72385e72a61dcb3fa3f0dc4c4a22824ff06e7859a169ab7fc7b82

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe
4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe
4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe
4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 2340	4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe	48
PID 4556 wrote to memory of 2356	4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe	47
PID 4556 wrote to memory of 2432	4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe	46
PID 4556 wrote to memory of 2800	4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe	35
PID 4556 wrote to memory of 3252	4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe	34

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2800

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2356

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2340

C:\Users\Admin\AppData\Local\Temp\75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe
"C:\Users\Admin\AppData\Local\Temp\75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-131-0x00007FF7DA9D0000-0x00007FF7DAD67000-memory.dmp

Filesize
3.6MB

Download
memory/2356-132-0x00007FF7DA9D0000-0x00007FF7DAD67000-memory.dmp

Filesize
3.6MB

Download