3500d96ea12fc67e55177d0c4db81e0cbd86b6d7974e741ff1a49116a6b4f8c8 | Triage

Analysis

max time kernel
44s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20-02-2022 08:36

Sharing

Report Analysis Logs

General

Target

3500d96ea12fc67e55177d0c4db81e0cbd86b6d7974e741ff1a49116a6b4f8c8.exe
Size

200KB
MD5

7d6d8c3caadbd235247c750ce3280e0f
SHA1

223b210cdbeb47ff015180150730c6a0057fa000
SHA256

3500d96ea12fc67e55177d0c4db81e0cbd86b6d7974e741ff1a49116a6b4f8c8
SHA512

dfc3f55204755be47a5d7273dfa66d1dfc1bfc7e97ccfd48aca5a7e4c8c5eea2b85a6cfb17ba990fa69259be46e3d7c6134e2b47cfe2be0f42227cd3df349e8c

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4024	3500d96ea12fc67e55177d0c4db81e0cbd86b6d7974e741ff1a49116a6b4f8c8.exe
4024	3500d96ea12fc67e55177d0c4db81e0cbd86b6d7974e741ff1a49116a6b4f8c8.exe
4024	3500d96ea12fc67e55177d0c4db81e0cbd86b6d7974e741ff1a49116a6b4f8c8.exe
4024	3500d96ea12fc67e55177d0c4db81e0cbd86b6d7974e741ff1a49116a6b4f8c8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	3500d96ea12fc67e55177d0c4db81e0cbd86b6d7974e741ff1a49116a6b4f8c8.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 2352	4024	3500d96ea12fc67e55177d0c4db81e0cbd86b6d7974e741ff1a49116a6b4f8c8.exe	74
PID 4024 wrote to memory of 2360	4024	3500d96ea12fc67e55177d0c4db81e0cbd86b6d7974e741ff1a49116a6b4f8c8.exe	73
PID 4024 wrote to memory of 2452	4024	3500d96ea12fc67e55177d0c4db81e0cbd86b6d7974e741ff1a49116a6b4f8c8.exe	72
PID 4024 wrote to memory of 2912	4024	3500d96ea12fc67e55177d0c4db81e0cbd86b6d7974e741ff1a49116a6b4f8c8.exe	65
PID 4024 wrote to memory of 3276	4024	3500d96ea12fc67e55177d0c4db81e0cbd86b6d7974e741ff1a49116a6b4f8c8.exe	64

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2912

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2360

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2352

C:\Users\Admin\AppData\Local\Temp\3500d96ea12fc67e55177d0c4db81e0cbd86b6d7974e741ff1a49116a6b4f8c8.exe
"C:\Users\Admin\AppData\Local\Temp\3500d96ea12fc67e55177d0c4db81e0cbd86b6d7974e741ff1a49116a6b4f8c8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-130-0x00007FF6F7250000-0x00007FF6F7529000-memory.dmp

Filesize
2.8MB

Download
memory/2360-131-0x00007FF6F7250000-0x00007FF6F7529000-memory.dmp

Filesize
2.8MB

Download