Overview

overview

3

Static

static

3

intelsoftw...ce.exe

windows7_x64

1

intelsoftw...ce.exe

windows10-2004_x64

1

Analysis

  • max time kernel
    239s
  • max time network
    294s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 12:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    intelsoftwareassetmanagerservice.exe

  • Size

    3.1MB

  • MD5

    5bdebce7118d30a387fec0f9329c5437

  • SHA1

    83a66c54772017c6fa0e243bcf5bbfebd2c29518

  • SHA256

    b8f8ddaba5754af65c9b7c762d69e1b2bd3702307c41589977759d813bf78635

  • SHA512

    96676730f1529972ee7f6582d43d856ffeed4706d26042c961ed14598eb03c0be410c1fe4d993b5a2eb594a7de0eba5b9004c713e29ae7e932947beda1de80b4

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 5 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\intelsoftwareassetmanagerservice.exe
    "C:\Users\Admin\AppData\Local\Temp\intelsoftwareassetmanagerservice.exe"
    1⤵
      PID:4948
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ShowSplit.txt
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:3904
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
      1⤵
        PID:4120
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
        1⤵
          PID:1852
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k UnistackSvcGroup
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4240
        • C:\Windows\SysWOW64\DllHost.exe
          C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
          1⤵
            PID:2364
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:2128

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Privilege Escalation

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Discovery

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4240-130-0x000001D114E40000-0x000001D114E50000-memory.dmp
            Filesize

            64KB

            Download
          • memory/4240-131-0x000001D114F40000-0x000001D114F50000-memory.dmp
            Filesize

            64KB

            Download