Analysis

  • max time kernel
    171s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    22-02-2022 08:25

General

  • Target

    4b4e6ce587df768d5f3530aa8c2a3a75.exe

  • Size

    324KB

  • MD5

    4b4e6ce587df768d5f3530aa8c2a3a75

  • SHA1

    87169151f1c6b437966e5c54a683b3675d41af95

  • SHA256

    dece4adf99e29edff4ef336fe6f7c40ffb90abd46514985ef86ef7c4fe5e94ed

  • SHA512

    c060f9ce6594cfdd8043c16839bd6db65841b32288cffcec7fe21897611be76e0ae529d4668762478841d91ca6d4f74bbfbe109bb01ea3cfaaaeace1f47373db

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b4e6ce587df768d5f3530aa8c2a3a75.exe
    "C:\Users\Admin\AppData\Local\Temp\4b4e6ce587df768d5f3530aa8c2a3a75.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Windows\system32\fondue.exe
      "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
      2⤵
        PID:2564
    • C:\Windows\system32\MusNotifyIcon.exe
      %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
      1⤵
      • Checks processor information in registry
      PID:2560
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3812
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:1712

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads