5b1ab6fae05ca9005ee7026cc30fb79780c470d6a920a63383c3496381778fb5 | Triage

Analysis

max time kernel
56s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20-02-2022 06:57

Sharing

Report Analysis Logs

General

Target

5b1ab6fae05ca9005ee7026cc30fb79780c470d6a920a63383c3496381778fb5.exe
Size

129KB
MD5

d7697d0d692bd883e53036b906108d56
SHA1

cbff9d66d68fa67e40ca4a295daed68f0d5f8383
SHA256

5b1ab6fae05ca9005ee7026cc30fb79780c470d6a920a63383c3496381778fb5
SHA512

6b2dc807abecb6075e754c49baf703ec44ea9e45ae82ffdef855bbae85768605696071c8c7a3e333ce363df7434d2613be4db2052fe56ed30cab7154cd9246f6

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4392	5b1ab6fae05ca9005ee7026cc30fb79780c470d6a920a63383c3496381778fb5.exe
4392	5b1ab6fae05ca9005ee7026cc30fb79780c470d6a920a63383c3496381778fb5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4392	5b1ab6fae05ca9005ee7026cc30fb79780c470d6a920a63383c3496381778fb5.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 2352	4392	5b1ab6fae05ca9005ee7026cc30fb79780c470d6a920a63383c3496381778fb5.exe	54
PID 4392 wrote to memory of 2360	4392	5b1ab6fae05ca9005ee7026cc30fb79780c470d6a920a63383c3496381778fb5.exe	15
PID 4392 wrote to memory of 2452	4392	5b1ab6fae05ca9005ee7026cc30fb79780c470d6a920a63383c3496381778fb5.exe	53
PID 4392 wrote to memory of 3028	4392	5b1ab6fae05ca9005ee7026cc30fb79780c470d6a920a63383c3496381778fb5.exe	44
PID 4392 wrote to memory of 2912	4392	5b1ab6fae05ca9005ee7026cc30fb79780c470d6a920a63383c3496381778fb5.exe	18
PID 4392 wrote to memory of 3276	4392	5b1ab6fae05ca9005ee7026cc30fb79780c470d6a920a63383c3496381778fb5.exe	23

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2912

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3276

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3028
- C:\Users\Admin\AppData\Local\Temp\5b1ab6fae05ca9005ee7026cc30fb79780c470d6a920a63383c3496381778fb5.exe
  "C:\Users\Admin\AppData\Local\Temp\5b1ab6fae05ca9005ee7026cc30fb79780c470d6a920a63383c3496381778fb5.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4392

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2452

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-131-0x00007FF6435E0000-0x00007FF643963000-memory.dmp

Filesize
3.5MB

Download
memory/2912-132-0x00007FF6435E0000-0x00007FF643963000-memory.dmp

Filesize
3.5MB

Download