535cf4aae10b9beaae1893779cce05cfbd7767a854fa78401e1d9d46e8c212ed | Triage

Analysis

max time kernel
37s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20-02-2022 07:21

Sharing

Report Analysis Logs

General

Target

535cf4aae10b9beaae1893779cce05cfbd7767a854fa78401e1d9d46e8c212ed.exe
Size

206KB
MD5

3f4ab625f691c1f68d23c9c59af56d50
SHA1

62a7d68740a3064948805f31137befa0d57207f7
SHA256

535cf4aae10b9beaae1893779cce05cfbd7767a854fa78401e1d9d46e8c212ed
SHA512

ead89be0dd5d2b8417b5c375f1ed71ceb53558020b8652491ede416a6bf88fc094e1714bac1b0405a9c862ad10c31eff9dd9f1f814d977af17e86eb9ade52026

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2088	535cf4aae10b9beaae1893779cce05cfbd7767a854fa78401e1d9d46e8c212ed.exe
2088	535cf4aae10b9beaae1893779cce05cfbd7767a854fa78401e1d9d46e8c212ed.exe
2088	535cf4aae10b9beaae1893779cce05cfbd7767a854fa78401e1d9d46e8c212ed.exe
2088	535cf4aae10b9beaae1893779cce05cfbd7767a854fa78401e1d9d46e8c212ed.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2088	535cf4aae10b9beaae1893779cce05cfbd7767a854fa78401e1d9d46e8c212ed.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2268	2088	535cf4aae10b9beaae1893779cce05cfbd7767a854fa78401e1d9d46e8c212ed.exe	51
PID 2088 wrote to memory of 2288	2088	535cf4aae10b9beaae1893779cce05cfbd7767a854fa78401e1d9d46e8c212ed.exe	50
PID 2088 wrote to memory of 2412	2088	535cf4aae10b9beaae1893779cce05cfbd7767a854fa78401e1d9d46e8c212ed.exe	49
PID 2088 wrote to memory of 2660	2088	535cf4aae10b9beaae1893779cce05cfbd7767a854fa78401e1d9d46e8c212ed.exe	35
PID 2088 wrote to memory of 3204	2088	535cf4aae10b9beaae1893779cce05cfbd7767a854fa78401e1d9d46e8c212ed.exe	28

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2660

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2288

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2268

C:\Users\Admin\AppData\Local\Temp\535cf4aae10b9beaae1893779cce05cfbd7767a854fa78401e1d9d46e8c212ed.exe
"C:\Users\Admin\AppData\Local\Temp\535cf4aae10b9beaae1893779cce05cfbd7767a854fa78401e1d9d46e8c212ed.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-130-0x00007FF61A590000-0x00007FF61A927000-memory.dmp

Filesize
3.6MB

Download
memory/2288-131-0x00007FF61A590000-0x00007FF61A927000-memory.dmp

Filesize
3.6MB

Download