3c8d5a42b3b1e9ec4c489d8ec98ba60d6d107e62b2d1a2cc43570840374ff05f

General

Target
zd4vWiNB908TG99.exe
Size 1007KB
Sample200805-s73erknc3e
SHA256 3c8d5a42b3b1e9ec4c489d8ec98ba60d6d107e62b2d1a2cc43570840374ff05f
MD5 f3370ea593b2afe30af97925d3a63295
SHA1 628af1ff11ecd9101e73dc0971d432e1c64e26fe
SHA512 182118828e580fe8e0e1188be751c93fde397af83dbff40f79e439ab3858cd3ce04d81e6c18b9bf264734b92a5bd302746b7a036c6a956ba70020da25532654c
MD5 SHA1 SHA512

Score

6^/10

persistence

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1908	schtasks.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\WebMonitor-18e1 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-18e1.exe"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WebMonitor-18e1 = "C:\\Users\\Admin\\AppData\\Roaming\\WebMonitor-18e1.exe"	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1000	zd4vWiNB908TG99.exe
Token: SeShutdownPrivilege	1800	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 1908	1000	zd4vWiNB908TG99.exe	26
PID 1000 wrote to memory of 1908	1000	zd4vWiNB908TG99.exe	26
PID 1000 wrote to memory of 1908	1000	zd4vWiNB908TG99.exe	26
PID 1000 wrote to memory of 1908	1000	zd4vWiNB908TG99.exe	26
PID 1000 wrote to memory of 1800	1000	zd4vWiNB908TG99.exe	28
PID 1000 wrote to memory of 1800	1000	zd4vWiNB908TG99.exe	28
PID 1000 wrote to memory of 1800	1000	zd4vWiNB908TG99.exe	28
PID 1000 wrote to memory of 1800	1000	zd4vWiNB908TG99.exe	28
PID 1000 wrote to memory of 1800	1000	zd4vWiNB908TG99.exe	28
PID 1000 wrote to memory of 1800	1000	zd4vWiNB908TG99.exe	28
PID 1000 wrote to memory of 1800	1000	zd4vWiNB908TG99.exe	28
PID 1000 wrote to memory of 1800	1000	zd4vWiNB908TG99.exe	28
PID 1000 wrote to memory of 1800	1000	zd4vWiNB908TG99.exe	28
PID 1000 wrote to memory of 1800	1000	zd4vWiNB908TG99.exe	28
PID 1000 wrote to memory of 1800	1000	zd4vWiNB908TG99.exe	28
PID 1000 wrote to memory of 1800	1000	zd4vWiNB908TG99.exe	28
PID 1000 wrote to memory of 1800	1000	zd4vWiNB908TG99.exe	28

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1000 set thread context of 1800	1000	zd4vWiNB908TG99.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1800	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\zd4vWiNB908TG99.exe
"C:\Users\Admin\AppData\Local\Temp\zd4vWiNB908TG99.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1000
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TqIIWvfdyqgCej" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1B8B.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1800