4a0daade9f3d9bd65932448a0ad5fb0ba23111e58ffb0b104237198b7ff21f67

Analysis

Target
Specifications.exe
Size 1.1MB
Sample220221-2lrggsbcd8
SHA256 c0c08f58ab9503aec6bc937a6e3f648d743d50c68726deffbdad61eefb07ad48
MD5 d597017d265b020b0e98d9f080320b49
SHA1 7a9252623020ef2e4844e190afdc736fd79bf0d1
SHA512 7a1dbd9d2a63484de9201827d0266ab20c9a02a51e369c27d1092265875efda501215261c670e54d3b9db418caaffab3f54c4e9275dc51b91122f4c0b9ac1d1d
MD5 SHA1 SHA512

Score

4^/10

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4820	svchost.exe
Token: SeCreatePagefilePrivilege	4820	svchost.exe
Token: SeShutdownPrivilege	4820	svchost.exe
Token: SeCreatePagefilePrivilege	4820	svchost.exe
Token: SeShutdownPrivilege	4820	svchost.exe
Token: SeCreatePagefilePrivilege	4820	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 2268	4200	Specifications.exe	82
PID 4200 wrote to memory of 2268	4200	Specifications.exe	82
PID 4200 wrote to memory of 2268	4200	Specifications.exe	82
PID 2268 wrote to memory of 4176	2268	fondue.exe	83
PID 2268 wrote to memory of 4176	2268	fondue.exe	83

C:\Users\Admin\AppData\Local\Temp\Specifications.exe
"C:\Users\Admin\AppData\Local\Temp\Specifications.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:4176

memory/4820-133-0x000001E330F90000-0x000001E330FA0000-memory.dmp

Download

memory/4820-134-0x000001E331620000-0x000001E331630000-memory.dmp

Download

memory/4820-135-0x000001E333D10000-0x000001E333D14000-memory.dmp

Download