Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
02/08/2024, 16:50
General
- Target svchost.exe
- Size 704KB
- Sample240802-vcrybswgrg
- SHA256 e5c643f1d8ecc0fd739d0bbe4a1c6c7de2601d86ab0fff74fd89c40908654be5
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1464-0-0x00007FFCA4375000-0x00007FFCA4376000-memory.dmp
memory/1464-1-0x00007FFCA40C0000-0x00007FFCA4A61000-memory.dmp
memory/1464-2-0x000000001BAA0000-0x000000001BF6E000-memory.dmp
memory/1464-3-0x000000001D0A0000-0x000000001D13C000-memory.dmp
memory/1464-4-0x000000001D140000-0x000000001D1A2000-memory.dmp
memory/1464-5-0x000000001B580000-0x000000001B588000-memory.dmp
memory/1464-6-0x000000001D5B0000-0x000000001D602000-memory.dmp
memory/1464-14-0x00007FFCA40C0000-0x00007FFCA4A61000-memory.dmp
memory/1464-15-0x00007FFCA4375000-0x00007FFCA4376000-memory.dmp
memory/1464-16-0x00007FFCA40C0000-0x00007FFCA4A61000-memory.dmp
memory/1464-17-0x00007FFCA40C0000-0x00007FFCA4A61000-memory.dmp