5a604a8f0e72f3bf7901b7b67f881031a402ab8072269c00233a554df548f54d | Triage

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
22-02-2022 02:18

Sharing

Report Analysis Logs

General

Target

5a604a8f0e72f3bf7901b7b67f881031a402ab8072269c00233a554df548f54d.exe
Size

2.9MB
MD5

9502d64e8f8c0f50127e2a7263596891
SHA1

23006c877ccc883460497ad35df82e64f338cfc9
SHA256

5a604a8f0e72f3bf7901b7b67f881031a402ab8072269c00233a554df548f54d
SHA512

92ad471a82942f513ea2703623e734a3e2c8d740a52de0abf23c6f78a128f8a6bac1516fae26ba05ccfbab24cb32a37df5d3803bd3bd2aad7400fa48fb19c318

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4028	svchost.exe
Token: SeCreatePagefilePrivilege	4028	svchost.exe
Token: SeShutdownPrivilege	4028	svchost.exe
Token: SeCreatePagefilePrivilege	4028	svchost.exe
Token: SeShutdownPrivilege	4028	svchost.exe
Token: SeCreatePagefilePrivilege	4028	svchost.exe

C:\Users\Admin\AppData\Local\Temp\5a604a8f0e72f3bf7901b7b67f881031a402ab8072269c00233a554df548f54d.exe
"C:\Users\Admin\AppData\Local\Temp\5a604a8f0e72f3bf7901b7b67f881031a402ab8072269c00233a554df548f54d.exe"
1⤵
PID:2484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4028-130-0x0000017EF6530000-0x0000017EF6540000-memory.dmp

Filesize
64KB

Download
memory/4028-131-0x0000017EF6590000-0x0000017EF65A0000-memory.dmp

Filesize
64KB

Download
memory/4028-132-0x0000017EF92A0000-0x0000017EF92A4000-memory.dmp

Filesize
16KB

Download