8aef7422bb8ccc4560fb78875a0fb5d4644108a905febacd2b609012930e5744

General

Target
5BHHnXWAUJXWYQP.exe
Size 1.3MB
Sample200717-wsj53ry12a
SHA256 8aef7422bb8ccc4560fb78875a0fb5d4644108a905febacd2b609012930e5744
MD5 b9bc024812225caa1d0e78f34e336f6e
SHA1 8c16b59570b5ecd6c411d222de9d0f53d2c83ec0
SHA512 78d974d5e60baa1d5bf3dbd0c1f7b28742f25b2cd58f4bbdd7cafd07d21f5231852d20f499f9fca99a3030b644f7f3ecd1c9dd942f0278cc65011d3212fed272
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2036	1496	5BHHnXWAUJXWYQP.exe	26
PID 1496 wrote to memory of 2036	1496	5BHHnXWAUJXWYQP.exe	26
PID 1496 wrote to memory of 2036	1496	5BHHnXWAUJXWYQP.exe	26
PID 1496 wrote to memory of 2036	1496	5BHHnXWAUJXWYQP.exe	26
PID 1496 wrote to memory of 1788	1496	5BHHnXWAUJXWYQP.exe	28
PID 1496 wrote to memory of 1788	1496	5BHHnXWAUJXWYQP.exe	28
PID 1496 wrote to memory of 1788	1496	5BHHnXWAUJXWYQP.exe	28
PID 1496 wrote to memory of 1788	1496	5BHHnXWAUJXWYQP.exe	28
PID 1496 wrote to memory of 1100	1496	5BHHnXWAUJXWYQP.exe	29
PID 1496 wrote to memory of 1100	1496	5BHHnXWAUJXWYQP.exe	29
PID 1496 wrote to memory of 1100	1496	5BHHnXWAUJXWYQP.exe	29
PID 1496 wrote to memory of 1100	1496	5BHHnXWAUJXWYQP.exe	29
PID 1496 wrote to memory of 1780	1496	5BHHnXWAUJXWYQP.exe	30
PID 1496 wrote to memory of 1780	1496	5BHHnXWAUJXWYQP.exe	30
PID 1496 wrote to memory of 1780	1496	5BHHnXWAUJXWYQP.exe	30
PID 1496 wrote to memory of 1780	1496	5BHHnXWAUJXWYQP.exe	30
PID 1496 wrote to memory of 1816	1496	5BHHnXWAUJXWYQP.exe	31
PID 1496 wrote to memory of 1816	1496	5BHHnXWAUJXWYQP.exe	31
PID 1496 wrote to memory of 1816	1496	5BHHnXWAUJXWYQP.exe	31
PID 1496 wrote to memory of 1816	1496	5BHHnXWAUJXWYQP.exe	31
PID 1496 wrote to memory of 1768	1496	5BHHnXWAUJXWYQP.exe	32
PID 1496 wrote to memory of 1768	1496	5BHHnXWAUJXWYQP.exe	32
PID 1496 wrote to memory of 1768	1496	5BHHnXWAUJXWYQP.exe	32
PID 1496 wrote to memory of 1768	1496	5BHHnXWAUJXWYQP.exe	32

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1496	5BHHnXWAUJXWYQP.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2036	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\5BHHnXWAUJXWYQP.exe
"C:\Users\Admin\AppData\Local\Temp\5BHHnXWAUJXWYQP.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1496
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UQlNTvJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5012.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2036
- C:\Users\Admin\AppData\Local\Temp\5BHHnXWAUJXWYQP.exe
  "{path}"
  2⤵
  PID:1788
- C:\Users\Admin\AppData\Local\Temp\5BHHnXWAUJXWYQP.exe
  "{path}"
  2⤵
  PID:1100
- C:\Users\Admin\AppData\Local\Temp\5BHHnXWAUJXWYQP.exe
  "{path}"
  2⤵
  PID:1780
- C:\Users\Admin\AppData\Local\Temp\5BHHnXWAUJXWYQP.exe
  "{path}"
  2⤵
  PID:1816
- C:\Users\Admin\AppData\Local\Temp\5BHHnXWAUJXWYQP.exe
  "{path}"
  2⤵
  PID:1768