235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac | Triage

Analysis

max time kernel
35s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20-02-2022 09:19

Sharing

Report Analysis Logs

General

Target

235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac.exe
Size

129KB
MD5

5f7dd3740a3a4ea74e2ee234f6de26aa
SHA1

d9f8eb52ce514d3dbf8f8e6a1ecb29c1dc46ea12
SHA256

235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac
SHA512

8d7af1574a8c11312a7b02e4711c179b7ab9ebcaa426976368059ed97d5f438181df81058e08efcb7fac0d3c36a0c11a417c6536504f6ef2d476d144f2e9af4a

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4796	235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac.exe
4796	235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 2896	4796	235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac.exe	52
PID 4796 wrote to memory of 2916	4796	235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac.exe	53
PID 4796 wrote to memory of 2956	4796	235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac.exe	54
PID 4796 wrote to memory of 992	4796	235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac.exe	55
PID 4796 wrote to memory of 3008	4796	235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac.exe	58
PID 4796 wrote to memory of 3260	4796	235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac.exe	56

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2916

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2956

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:992
- C:\Users\Admin\AppData\Local\Temp\235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac.exe
  "C:\Users\Admin\AppData\Local\Temp\235ab3857ba2d2cd09311d6cc7bf1139863022579ea98be2b503921104ee20ac.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4796

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2896-130-0x00007FF665890000-0x00007FF665C12000-memory.dmp

Filesize
3.5MB

Download
memory/3008-131-0x00007FF665890000-0x00007FF665C12000-memory.dmp

Filesize
3.5MB

Download