Resubmissions

02-06-2022 22:15

220602-16kn1abhf3 10

02-06-2022 21:45

220602-1mh13abha3 7

02-06-2022 21:44

220602-1ln6pabgh8 8

02-06-2022 21:40

220602-1jcpwabgh5 10

02-06-2022 21:27

220602-1ay7hsffap 10

Analysis

  • max time kernel
    90s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    02-06-2022 21:27

General

  • Target

    Scan_282.jpg.lnk

  • Size

    1KB

  • MD5

    371924fdfffd4ca69857e94260c34a74

  • SHA1

    2a1dc23c24010a8b5ef3b512ea3e3c6d2f52a44b

  • SHA256

    801086851a46749a95efc050102fb85b761c0ccb191dfd29ff39c6b7cacb6292

  • SHA512

    f9cbf21c27cf3473a2b73141dfd728d9d8824d20afc24f4b4b93ca5bf9536bd594c7a6d4100be2a2fc9c8e4b85b9dcf9797f61f60267128ea31cb44bfb43aba0

Score
10/10

Malware Config

Signatures

  • DoubleBack

    DoubleBack is a modular backdoor first seen in December 2020.

  • DoubleBack x64 Payload 4 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Scan_282.jpg.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1496
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -file 1728.ps1
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:932
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe
        3⤵
        • Blocklisted process makes network request
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:956
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -c "&{$v1='2232';$k1='hkcu:\Software\Classes\CLSID';$p1=(gp $k1).$v1;rp $k1 $v1;set-itemproperty -pat $k1 -n $v1 -va (($p1|iex)|out-string);exit}"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2976

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/932-137-0x000002BEFE349000-0x000002BEFE34F000-memory.dmp
    Filesize

    24KB

  • memory/932-138-0x000002BE825F0000-0x000002BE825FA000-memory.dmp
    Filesize

    40KB

  • memory/932-132-0x00007FFC2E530000-0x00007FFC2EFF1000-memory.dmp
    Filesize

    10.8MB

  • memory/932-133-0x000002BEFE349000-0x000002BEFE34F000-memory.dmp
    Filesize

    24KB

  • memory/932-134-0x00007FFC2E530000-0x00007FFC2EFF1000-memory.dmp
    Filesize

    10.8MB

  • memory/932-135-0x000002BEFE349000-0x000002BEFE34F000-memory.dmp
    Filesize

    24KB

  • memory/932-131-0x000002BEE5EE0000-0x000002BEE5F02000-memory.dmp
    Filesize

    136KB

  • memory/932-136-0x00007FFC2E530000-0x00007FFC2EFF1000-memory.dmp
    Filesize

    10.8MB

  • memory/932-130-0x0000000000000000-mapping.dmp
  • memory/932-139-0x0000008800000000-0x000000880000E000-memory.dmp
    Filesize

    56KB

  • memory/956-140-0x0000008800000000-0x000000880000E000-memory.dmp
    Filesize

    56KB

  • memory/956-144-0x0000008800000000-0x000000880000E000-memory.dmp
    Filesize

    56KB

  • memory/2976-141-0x0000000000000000-mapping.dmp
  • memory/2976-142-0x00007FFC2E530000-0x00007FFC2EFF1000-memory.dmp
    Filesize

    10.8MB

  • memory/2976-143-0x00007FFC2E530000-0x00007FFC2EFF1000-memory.dmp
    Filesize

    10.8MB