1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591 | Triage

Analysis

max time kernel
89s
max time network
201s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-02-2022 15:54

Sharing

Report Analysis Logs

General

Target

1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292.exe
Size

114KB
MD5

3f4a16b29f2f0532b7ce3e7656799125
SHA1

61b25d11392172e587d8da3045812a66c3385451
SHA256

1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591
SHA512

32acaceda42128ef9e0a9f36ee2678d2fc296fda2df38629eb223939c8a9352b3bb2b7021bb84e9f223a4a26df57b528a711447b1451213a013fe00f9b971d80

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\fndr	1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292.exe
File opened for modification	C:\Windows\system32\Drivers\fndr	1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292.exe
File created	C:\Windows\system32\Drivers\fndr.sys	1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
632	Process not Found
632	Process not Found
632	Process not Found
632	Process not Found
632	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 0	2012	1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292.exe
Token: SeBackupPrivilege	2012	1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292.exe
Token: SeLoadDriverPrivilege	2012	1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292.exe

C:\Users\Admin\AppData\Local\Temp\1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292.exe
"C:\Users\Admin\AppData\Local\Temp\1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads