Analysis

  • max time kernel
    132s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    02-06-2022 20:53

General

  • Target

    Scan_314.jpg.lnk

  • Size

    1KB

  • MD5

    a43cd61911f636d590eb9a5edfc4777f

  • SHA1

    419c382c0311691ee2ba00537d640500d1896366

  • SHA256

    6ec963361dc22ff695854bbb3838856d78c1aef73ea07fc855b6d82b57ca51b1

  • SHA512

    b8889b2f6cde2f85bdcdbe7f529bcdfb6637ec7b29c8f0d1198e954467fb404e1441195942abdb6029bdad5a224628fd05d8f6f8fe0431eb5d9bd13d2e2d7958

Score
10/10

Malware Config

Signatures

  • DoubleBack

    DoubleBack is a modular backdoor first seen in December 2020.

  • DoubleBack x64 Payload 4 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Scan_314.jpg.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1480
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -file 1204.ps1
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3492
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe
        3⤵
        • Blocklisted process makes network request
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4724
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -c "&{$v1='1124';$k1='hkcu:\Software\Classes\CLSID';$p1=(gp $k1).$v1;rp $k1 $v1;set-itemproperty -pat $k1 -n $v1 -va (($p1|iex)|out-string);exit}"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4740

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3492-136-0x00007FF8B73B0000-0x00007FF8B7E71000-memory.dmp

    Filesize

    10.8MB

  • memory/3492-137-0x000001E5417B9000-0x000001E5417BF000-memory.dmp

    Filesize

    24KB

  • memory/3492-132-0x00007FF8B73B0000-0x00007FF8B7E71000-memory.dmp

    Filesize

    10.8MB

  • memory/3492-133-0x00007FF8B73B0000-0x00007FF8B7E71000-memory.dmp

    Filesize

    10.8MB

  • memory/3492-134-0x000001E5417B9000-0x000001E5417BF000-memory.dmp

    Filesize

    24KB

  • memory/3492-135-0x000001E5417B9000-0x000001E5417BF000-memory.dmp

    Filesize

    24KB

  • memory/3492-131-0x000001E541720000-0x000001E541742000-memory.dmp

    Filesize

    136KB

  • memory/3492-138-0x000001E5435D0000-0x000001E5435DA000-memory.dmp

    Filesize

    40KB

  • memory/3492-130-0x0000000000000000-mapping.dmp

  • memory/3492-139-0x0000008800000000-0x000000880000E000-memory.dmp

    Filesize

    56KB

  • memory/4724-140-0x0000008800000000-0x000000880000E000-memory.dmp

    Filesize

    56KB

  • memory/4724-144-0x0000008800000000-0x000000880000E000-memory.dmp

    Filesize

    56KB

  • memory/4740-141-0x0000000000000000-mapping.dmp

  • memory/4740-142-0x00007FF8B73B0000-0x00007FF8B7E71000-memory.dmp

    Filesize

    10.8MB

  • memory/4740-143-0x00007FF8B73B0000-0x00007FF8B7E71000-memory.dmp

    Filesize

    10.8MB