14bc7146562bb679d9e708f1f748512a140a4a32e2ae1d7a8de6c971b5639686

Analysis

max time kernel
147s
max time network
142s
platform
windows7_x64
resource
win7v200430
submitted
09/07/2020, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SPEC ORDER #3081.exe
Size

375KB
MD5

383949d00c81b2a7ca1c5b225a4e268d
SHA1

166b82c1363bbf1d48ae27291cd6b8205e8908ed
SHA256

14bc7146562bb679d9e708f1f748512a140a4a32e2ae1d7a8de6c971b5639686
SHA512

567592a32dd2cdbca984ee6eb74e4985143e852f6ba433d8cc26fbb7ef36cc55c6f83617218a4719b1d07ee9c19abb7cc9dab21e52bd060554621bd054f75f64

Score

8^/10

persistence

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	SPEC ORDER #3081.exe
Token: SeDebugPrivilege	768	images.exe

Executes dropped EXE 2 IoCs

pid	Process
768	images.exe
1332	images.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1816	schtasks.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe"	SPEC ORDER #3081.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1332	images.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1816	1292	SPEC ORDER #3081.exe	26
PID 1292 wrote to memory of 1816	1292	SPEC ORDER #3081.exe	26
PID 1292 wrote to memory of 1816	1292	SPEC ORDER #3081.exe	26
PID 1292 wrote to memory of 1816	1292	SPEC ORDER #3081.exe	26
PID 1292 wrote to memory of 1812	1292	SPEC ORDER #3081.exe	28
PID 1292 wrote to memory of 1812	1292	SPEC ORDER #3081.exe	28
PID 1292 wrote to memory of 1812	1292	SPEC ORDER #3081.exe	28
PID 1292 wrote to memory of 1812	1292	SPEC ORDER #3081.exe	28
PID 1292 wrote to memory of 1812	1292	SPEC ORDER #3081.exe	28
PID 1292 wrote to memory of 1812	1292	SPEC ORDER #3081.exe	28
PID 1292 wrote to memory of 1812	1292	SPEC ORDER #3081.exe	28
PID 1292 wrote to memory of 1812	1292	SPEC ORDER #3081.exe	28
PID 1292 wrote to memory of 1812	1292	SPEC ORDER #3081.exe	28
PID 1292 wrote to memory of 1812	1292	SPEC ORDER #3081.exe	28
PID 1292 wrote to memory of 1812	1292	SPEC ORDER #3081.exe	28
PID 1292 wrote to memory of 1812	1292	SPEC ORDER #3081.exe	28
PID 1812 wrote to memory of 768	1812	SPEC ORDER #3081.exe	29
PID 1812 wrote to memory of 768	1812	SPEC ORDER #3081.exe	29
PID 1812 wrote to memory of 768	1812	SPEC ORDER #3081.exe	29
PID 1812 wrote to memory of 768	1812	SPEC ORDER #3081.exe	29
PID 768 wrote to memory of 1332	768	images.exe	30
PID 768 wrote to memory of 1332	768	images.exe	30
PID 768 wrote to memory of 1332	768	images.exe	30
PID 768 wrote to memory of 1332	768	images.exe	30
PID 768 wrote to memory of 1332	768	images.exe	30
PID 768 wrote to memory of 1332	768	images.exe	30
PID 768 wrote to memory of 1332	768	images.exe	30
PID 768 wrote to memory of 1332	768	images.exe	30
PID 768 wrote to memory of 1332	768	images.exe	30
PID 768 wrote to memory of 1332	768	images.exe	30
PID 768 wrote to memory of 1332	768	images.exe	30
PID 768 wrote to memory of 1332	768	images.exe	30

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1292 set thread context of 1812	1292	SPEC ORDER #3081.exe	28
PID 768 set thread context of 1332	768	images.exe	30

Loads dropped DLL 1 IoCs

pid	Process
1812	SPEC ORDER #3081.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
768	images.exe

C:\Users\Admin\AppData\Local\Temp\SPEC ORDER #3081.exe
"C:\Users\Admin\AppData\Local\Temp\SPEC ORDER #3081.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1292
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DswthclIDine" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7609.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1816
- C:\Users\Admin\AppData\Local\Temp\SPEC ORDER #3081.exe
  "{path}"
  2⤵
  - Adds Run entry to start application
  - Suspicious use of WriteProcessMemory
  - Loads dropped DLL
  PID:1812
- - C:\ProgramData\images.exe
    "C:\ProgramData\images.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:768
  - - C:\ProgramData\images.exe
      "{path}"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1332-16-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/1812-6-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/1812-4-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download