646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629 | Triage

Analysis

max time kernel
31s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20/02/2022, 06:31

Sharing

Report Analysis Logs

General

Target

646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
Size

212KB
MD5

3920d0157efcfbc01837be686e636a8d
SHA1

494414c45d655abf60b393c7c299f7647c0dbe1d
SHA256

646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629
SHA512

30ad22af397df2f0d4757e9fe45a17cdee92a19ed582b93fc24250a6bb3713b8fa01d487deae5fb99b46519ffa3c007b4805a3b785d64ebd8c27d6459879eb48

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1236	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
1236	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
1236	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
1236	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1236	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 2344	1236	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	71
PID 1236 wrote to memory of 2372	1236	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	33
PID 1236 wrote to memory of 2468	1236	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	70
PID 1236 wrote to memory of 1148	1236	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	65
PID 1236 wrote to memory of 3248	1236	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	64

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2372

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1148

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2468

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2344

C:\Users\Admin\AppData\Local\Temp\646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
"C:\Users\Admin\AppData\Local\Temp\646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2344-133-0x00007FF648FD0000-0x00007FF649367000-memory.dmp

Filesize
3.6MB

Download
memory/2372-134-0x00007FF648FD0000-0x00007FF649367000-memory.dmp

Filesize
3.6MB

Download