29b732557cb9e5f15b0c92ce6efb0c2c5ef22bd59068f3a87d40c4560ebaa2b5 | Triage

Analysis

max time kernel
147s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 09:12

Sharing

Report Analysis Logs

General

Target

EBcdssvc.exe
Size

20KB
MD5

134454ccda9649c659682fa0b1d5d687
SHA1

1db5be866ccf1f677ae54196489e4abbbc1b1c29
SHA256

3c3d9f236f4b70f2bdc48a61953b5f72696628e86c3f53f8070df66e70d5e347
SHA512

77ada47a7bb607224db3ace6274b6e27a497389c8573046decad6409beba1392e53a95bf4971ee0c212611145ed48003de3f72d8534b9fa7f520ca0ebe56107c
SSDEEP

192:zN71oEkRd/1FB0dFjXqCZX19xK9C6a0BuCBWLSTU8Ru01oy7l:unFB0dFj6Cp1+s6xBW+Tz1b

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	EBcdssvc.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	EBcdssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	EBcdssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	EBcdssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	EBcdssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	EBcdssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	EBcdssvc.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe
2972	EBcdssvc.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe
Token: SeTcbPrivilege	2972	EBcdssvc.exe

C:\Users\Admin\AppData\Local\Temp\EBcdssvc.exe
"C:\Users\Admin\AppData\Local\Temp\EBcdssvc.exe"
1⤵
PID:1028

C:\Users\Admin\AppData\Local\Temp\EBcdssvc.exe
C:\Users\Admin\AppData\Local\Temp\EBcdssvc.exe
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads