Analysis
- max time kernel
118s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
26/03/2022, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
- Size 131KB
- Sample220326-bfwk5seee6
- SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
- MD5 c4f79edc4498c5570495bb36fc942134
- SHA1 00046b588252502480e8e708a22d25ae1d9b05fa
- SHA512 07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Modifies data under HKEY_USERS 6 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000679dd12e611b91059d59013a6ac564eb2c39c1670cd7796dbf6de4634f76a306000000000e8000000002000020000000de3ce9643fff9b8ecd739571fea05341f13a4cf221853322af9f81fd25578541100d00009fb5faeec6dceb36eca5d805a045e6993264e1641f1f39b04726c72825464b1eac040929c0f3e2af7ffd469e8ce10e54f1ea0326ae745189492064f27d71e2fc28af354fab66d89aef1601fe0ee0190032f5e6467e6ffad1ce1528890c8200c1ff4aa90dbd4755f85650332ff9e2c88c034ce4f1777c60897fe263343e4c9edc918799ee9438f7d0c504a17dc1b7af1047b312772367f50dd9217b96c259b9101014f1698c487fb843dab0474ce01feb779be1cc5ac41e266ebe66ced803a7e7ef96992790b153e215fe2dd442e70d14491246a63cb37a2b842d8191f60d66e97b491d4df855285d07b54b55af0491472b78b3b4b76c12d100db7b74d7653655d541807df42841fb2678809b858445964d5925b97d0918bfa6c2853549f3f2921a328509cc041bff68d0f3ab77b1e0984ab88f9a0744598b10c8d99ba1b6b2b88235c279f3c8a381a7a0a99f1c01ea362b02e90f140ed017c8b5151b2e7838a3aeb9f19297300bcdca647ebb9eb993be0093b3b1e44cade60d49ae0b9ac972e11e44e96bb255bb14d9e4f42cbc866de242485f07198f592c86fa965fc513d3bbf497f75c72329d9cd4dc0b6d9225f7b57a0685a65b17479bd9faaea08740405c7f1b555d7df85f447775ce8bdce783277213d097df41503eb3598e14bb9d433cf572012dac33d0e54eba7654be64426771f6df578f854c6278f9039421ba5b64025369f935e6a03238846d29a5053b75d7f26d826d0f2d92baa39dbbf2f5945029813e1941c7629ecaa5bef543205c6dad6de79858c850c62fc7bab0e0a5793dade76dcc2c82cd049439dfd29d97f3b3407a4bf117ea0e7e183c75f4513d27a3a32b90fe701de8f1ebd7b0cee702969a8d2bf65b4016137f8bed7003f2ab70f9e9b41ae2c5b96cc50e93d71af478661991a70f274d1bcda2c46716a19e344137c6b743b7654e97144990a1dc10020101f3dcd002e75714b82c531fdad8988029d3cf94c1e4a95e4c49d87386ffd8574f615511883bcfab00ac25b64af82491a4ca651bd8698de2e0c9b37c66e8c912988e5307e9399a5854cbd075518147488fced0835b36cab49f0f1bea3a0b7691a92159d11f438c6b8b79a1cad53e475fd263fb18deccf214f49e582a2f530c01149da642ac3bce689699dba72dbc8c96e36950e1698989590bb3027edbd04b6d3dd691d9effaf196c2c96e019a05756d660c1203c4b0019b347742633fa5fabcb51d17743522982d3a4082de20f6f106ae8cb4878d0467560449a1cd5f0b35e32cc32405b267a69268b7d9dabdbbebfd49337a7ee436a4a3a50b25ff4f601a4346df44e79c01e59b9e26696d77943cb88a7a79206a8d1b31054eca4af1b2569c433a8a3ba69bb8a0e2549c9136a11fb894906cc416799c98d63078b55b346042450dc5c1938463e1d63e8f4f526e8cd1122dc1f9b51a5ec8f1f96b873227e85ba951b3bf486a7ac1568412aababf4bdddeae935142cd6a3b1d78510dd5891c3e2109ea01f65a8b3d588a1fe54c801cd9cd1e9c78046eb40872a8e833826fc35486689c8de5e12e49b81033de167a09cfcc8bda6a1248bc16d710c55fd4fa479f50b331dfd90371e82acba87cffb1f563bdd40a23820f8a9e0b4d6080e3bbdf04e9fc205b6e86bd2d2baef047e701c2a6ee01a8dd8399d8aa1a79242bbb302f65a1536ee60652804e851e9bb0821afa2ab06269fcd0b5a05e5bf66131886b9de3c8b339fe1c874b6aadb3e0fcdf9091de180f2b165bad2eebd70ac056f9210311d936f9bc5dd639ac00a89d36f1dec962772f8c8cb75d76e8ce00b0b7740c3edd94217e015e9703d63415811c60328fe14d9bb6308ea86404f8f6525d0be1cca7e32acc9026f7073ee82a7c0b93ec3569e1d7ee8779c01854c9cb464d7c3ba1f93b142f83a3c0985159b39af326776cb88b63877276333769c29d6fb17db06c4df6e97352013b6ae082402ce51e57195e055145eabf0764a65ec80cf45d60cf3e9bb7ee16c48c28fac39af78f436c1cd3739d25fae0c616624611061d5adef02b691ec081acb7811ca64331b6f221169399b559d4d5b4ccac7c31d85d597ea84f1657547ed325779c6249a8495124d46905139afe23a436c367d0fb97fb579e4272b42fd08de923df0227b30c9c4e26ea47243460d3b88712f32b159e7523506d57d0209b61aac1a044450ddf054ad834de8124d997070e1a51fb02424dff8197de816f93f7d2b69e45877f3d118a24cbd123573fc18dd71ec916dfd4c67ff070acc35afe07128a6abea4d06714b255c3459f71b438ff22321c501f4a8072012b0647aa2f59b671192e3203ab7c7ed74c0186ce541275502749f39bfcf1be11695303ae8416bf68c4d767755288dab6e91c96c8dfa04e56d05741e744c07ce003aca85f5e9e928f83367e8b98414d9edba46c080b7fa58349983e57dad9143d15fce306580bb6e9f82caad7d7de7cb806d0cf4d4cba2d372ce3886d3f230a4c40cf8666d9930f1490dc24368cbe73282d230d6a819bb659624df441929f8b830da714e1377ad3e576ff58f6ef9e484dcea5be6d6c703f55ca0de145c9df252885ab085c2b2dc3c7b18d24291a6801825ebbf4e42592641f8f3ccb30358dbdbda6a685647e9a78eb55743e80f0a3df58cdd4fd560ab21b3d0cec1a2d523215837c05986ca03fb7d3af4234901bdf53caed7981db2690d938400c883246a718c645c1f7b31ee5360458d5d1d143ac3bc90377667a2a397a341a1555533baa990c0724c635f11c3f4de66a1478f5f3695907b26f0b8e6268f289fff373751826fefc502f64e82178ec154c322857db11db3103e6018a5ce759e980a24240a9bc68928d707bd2e52317afc268f57aca6df8724dd7ad4092d13aa26e0d32c73de289d688998019eb2ab38c447e8f090670485e4b6fc36de56d3e26e6ee1a6f195e8c974503caa34df83ecfe4fee0f4e881fc463d6a8e03f3c3b99b774907ab23e24b95dc08fc9928c692b2c1f9b6f54c133663f1fd7f4308c7650231ba80c370f716f2e9ebc9026644654cb1c52d730ee226a39f632eef986bc19b0b0e86b66a5d6ed6286622781c0e30ac07d1c3c3f0e31812db36f0ff17da978127fdb3414bac91c7e979e1f502aecd818c37499a351517d7d1f8f1c6cb6e44935a511800f820d339ab5dbf6660e05645eff4c810b2ad10c80ae4a3f2e99068bcf7e2f2e6e2d7551f64d8295ba2d3aceeec0f14948e3fe668efaf4f5b2333a90ce73353bb0228e5892ec2d5141a56544bc0bc18b00c0ab2c90acc79a4b2daa8fb5948794e98109c3b5c0d7663309596aaaa14a65981d8609a59d520e61211d7d744d805b05eba22779ba5eb122849e677203973c6624dbab7c6076b25b9413e2402405555917a4d16aaedb3de0f00f42bbf587012c3ba6d8de83bc69316d628bc361ba3f995724fa0c1b119d2b31da56bdc8acc3486d62549e9bcc730cee71513482b9aff15e06b412539267cac462a4db71422a579409f52103437befa1fccd0e9da1354aab11414c2846f333754f42aa415975b25fc9b9ba719162f7a05f9e9bece937b1dea75cddc1d6965f945881e5c465ea53f0653cabcf104906c61373d2169416a808333a5ce2891db18a630c6bc2cca804f57635a61527bcc7d3609b521b5a11ddc76619bdc90e5883179411dc2c5c467ad126187b304f1f2942e67f9a5cc070e86dd0336816e5dd1182a00745d8293a2704e9b5e7be577b36444d7169f71b7e9cfd43638204cdd1eade4fd2369bcae09ded7d6933142a1c582107a175fb960cd694d9d1a643ed6bef5bf9584cdfe122dc0ef8a35e4f10e08eb4cb8b7f61e1e00d108f4d68e9f4fb16c9b565015d48d529f5a354bb1b173161c5d6512d5ed024035377b61ba8023762336eebe10fa75c16d6a5d7b673313a59b290302dee9ba68069b9c9596d51f0eb8edd87e9351d972b65d0104320241d7c07e583a51559b694dd099e2917620a12107dfec093c85a60867b7bb60de9eb4bf5f729f3ba8d1db297c7daf77a2d71938bf15bfc71270f5a14aae2688abd73488ed7fbe6e1fad7d5aa53381d614c49a5f666bec449a6b7d3ae862ec560083b272df1bd7a0a65d3ca70a8285b103b743cff5e60213b905bab7adc90e7d8226c76cb2dec5b105e2558ea1905fb8146de135bdf5b645522fd917df4e22a4383323064faf732a99d02850575acaa65796d6c52033247bf9da1e806a1ba49505ea4b801f41c7fc047b1b75ecaed3dbe3b3739f74a5ed214b24d5b7173b12fbd160b35d5b177498e5d7926cfbf6732ec97b617a6906c4017df895a7e3843a6f6aab7aa886469437ea301c17c34d1484b45280b7401b0b434ce8a57f3d1f4fc736d61fdd1004fd9187ffe3321a7b7f2fa3dbd4982373ca22f305271cd928c04a292551f49acf6c63687b23ac4e6d4723eb4067d04972121f8162e551bed9395206f05cccd67013cf9b74a3a4b3d1418077d08e715589a956274199abc116e047c002df51856250769f4ec282cae4681bfd2373f56353d24e1b52408a4cebf1a57d84e6d5c17ca9585c8c9f67eec3684db7ec5f2b2e1f54c4d8797aa2b5779a4654fab2ec6728d31d1ebb71e71960da470e002c16c0629a2f8d53e1be9d8906503d4dedba5c0b28c09893f29bf218dd911c046deb9b682d9fa35e60744facb9a8affd491fa3246114c0fb18816ccc26f140000000deacc1d4258a46d4b6e408d149cd7f51b035138d263ec1f24fdbe0d8b861fda395a09c1344dfc67ba63609ebdfd93bd701927350ced6c97be1e86b90994eb053 svchost.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "00188006BC367F1B" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\00188006BC367F1B = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000003caaac0025435df9e9202f9d583b0ac2c725067dd9ee69d09d2fe3b8e5a1b2a9000000000e8000000002000020000000030897989238e338c9bd426d138775d72a1844b2da3235ebe24044c7dcc7ab5b80000000ac91087383515c8e28d9fd199f981fb0c1f604301edecbf6cb89de56c1abbf88fb8788c0360d83aab3295ecb7da26be745f4bbb80b50a26249e6c4384bbfe660345ba2f38584ee30248c91791975a2330b4cb5b34c65c335efa633067544d9b4661329400aefd6d4b800265c880420e564bc4cbdcc6e811e02feea873e25693e40000000621660f97b55d0f0434e2093e5974b0f36c81f0126a2618f21eb94a542e74ca805a404c9b412fecbcd8d54074ff8431a34704c32efa856177fc48d9eccea9dfe svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5} svchost.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3800 wrote to memory of 1876 3800 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe 82 PID 3800 wrote to memory of 1876 3800 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\system32\fondue.exe"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll2⤵PID:1876
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
- Modifies data under HKEY_USERS
PID:824