Analysis
-
max time kernel
111s -
max time network
116s -
platform
windows7_x64 -
resource
win7 -
submitted
01-08-2020 19:31
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe
Resource
win7
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe
Resource
win10
General
-
Target
SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe
-
Size
729KB
-
MD5
532524e6b61b197d92f3bd4ed3331d3d
-
SHA1
f1009c96203862812cefa14e186dcff610ccc634
-
SHA256
3e3ab416abadd9093b15f9dcce92f3530709aba8addff16a74e89bd3a7bfd8fd
-
SHA512
5b83ef335563332bb62445ce0d180db0544b793a88b60efb122c990bfe5c00f6bbe5ed5e0437bf59415b989d85f85060434d6aa7b4c1a465672298c142079e03
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exeIdle.exepid process 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe 1312 Idle.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exedescription pid process target process PID 896 wrote to memory of 1512 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe schtasks.exe PID 896 wrote to memory of 1512 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe schtasks.exe PID 896 wrote to memory of 1512 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe schtasks.exe PID 896 wrote to memory of 1788 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe schtasks.exe PID 896 wrote to memory of 1788 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe schtasks.exe PID 896 wrote to memory of 1788 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe schtasks.exe PID 896 wrote to memory of 1808 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe schtasks.exe PID 896 wrote to memory of 1808 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe schtasks.exe PID 896 wrote to memory of 1808 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe schtasks.exe PID 896 wrote to memory of 1852 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe schtasks.exe PID 896 wrote to memory of 1852 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe schtasks.exe PID 896 wrote to memory of 1852 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe schtasks.exe PID 896 wrote to memory of 1880 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe schtasks.exe PID 896 wrote to memory of 1880 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe schtasks.exe PID 896 wrote to memory of 1880 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe schtasks.exe PID 896 wrote to memory of 1312 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe Idle.exe PID 896 wrote to memory of 1312 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe Idle.exe PID 896 wrote to memory of 1312 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe Idle.exe -
Executes dropped EXE 1 IoCs
Processes:
Idle.exepid process 1312 Idle.exe -
Drops file in Program Files directory 3 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exedescription ioc process File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Idle.exe SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Idle.exe SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\6ccacd8608530fba3a93e87ae2225c7032aa18c1 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1788 schtasks.exe 1808 schtasks.exe 1852 schtasks.exe 1880 schtasks.exe 1512 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exeIdle.exedescription pid process Token: SeDebugPrivilege 896 SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe Token: SeDebugPrivilege 1312 Idle.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Steam.18359.22695.22959.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Idle.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\f840bc82-aff2-11ea-839f-f21450b4f854\System.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "smss" /sc ONLOGON /tr "'C:\Documents and Settings\smss.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\f840bc82-aff2-11ea-839f-f21450b4f854\Idle.exe'" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Recovery\f840bc82-aff2-11ea-839f-f21450b4f854\Idle.exe"C:\Recovery\f840bc82-aff2-11ea-839f-f21450b4f854\Idle.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Recovery\f840bc82-aff2-11ea-839f-f21450b4f854\Idle.exe
-
C:\Recovery\f840bc82-aff2-11ea-839f-f21450b4f854\Idle.exe
-
memory/1312-5-0x0000000000000000-mapping.dmp
-
memory/1512-0-0x0000000000000000-mapping.dmp
-
memory/1788-1-0x0000000000000000-mapping.dmp
-
memory/1808-2-0x0000000000000000-mapping.dmp
-
memory/1852-3-0x0000000000000000-mapping.dmp
-
memory/1880-4-0x0000000000000000-mapping.dmp