5430394ea19a7c57dea6d2d07c389bb5fd12bb4e3e64f98911148ae0f870dfdf | Triage™

Analysis

max time kernel
2s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03/05/2022, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Telegram中文1版.exe
Size 2.1MB
Sample220503-mrnkfsfffj
SHA256 5430394ea19a7c57dea6d2d07c389bb5fd12bb4e3e64f98911148ae0f870dfdf
MD5 b84464a09e8d707d1d1d60be6158224d
SHA1 514ca38e20826863eac766857f97c05f269df219
SHA512 8ab31938a00b80d714ad352924c075bd5cd3d0f8c25ff7e11a9402176116084b4bd96f180bf6e19d189cfe1258067b8694289647108b37accbe191ee58b0e214
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1540	Telegram中文1版.exe
1540	Telegram中文1版.exe
1540	Telegram中文1版.exe
1540	Telegram中文1版.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2764	svchost.exe
Token: SeCreatePagefilePrivilege	2764	svchost.exe
Token: SeLoadDriverPrivilege	2260	svchost.exe
Token: SeShutdownPrivilege	2764	svchost.exe
Token: SeCreatePagefilePrivilege	2764	svchost.exe
Token: SeLoadDriverPrivilege	2260	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1540	Telegram中文1版.exe
1540	Telegram中文1版.exe
1540	Telegram中文1版.exe
1540	Telegram中文1版.exe

C:\Users\Admin\AppData\Local\Temp\Telegram中文1版.exe
"C:\Users\Admin\AppData\Local\Temp\Telegram中文1版.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Users\Admin\AppData\Local\Temp\Telegram中文1版.exe
"C:\Users\Admin\AppData\Local\Temp\Telegram中文1版.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads