Analysis
- max time kernel
110s - max time network
111s - platform
windows10_x64 - resource
win10 - submitted
08/08/2020, 08:31
General
- Target New_Inquiry_080820.exe
- Size 1.0MB
- Sample200808-vslyt9ebvx
- SHA256 3e4bbaedb75ecb1dba42d262fbb6c051d30dddbf7d10ceac4086836b67f1dd3a
Malware Config
Signatures
- Deletes itself 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
- Suspicious use of SetThreadContext 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New_Inquiry_080820.exe"C:\Users\Admin\AppData\Local\Temp\New_Inquiry_080820.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eOYCGE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC917.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\New_Inquiry_080820.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\New_Inquiry_080820.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\New_Inquiry_080820.exe'4⤵
- Deletes itself
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/916-32-0x0000000008150000-0x0000000008151000-memory.dmp
memory/916-30-0x0000000007830000-0x0000000007831000-memory.dmp
memory/916-36-0x0000000009FB0000-0x0000000009FB1000-memory.dmp
memory/916-35-0x0000000008910000-0x0000000008911000-memory.dmp
memory/916-34-0x0000000008690000-0x0000000008691000-memory.dmp
memory/916-33-0x0000000007F60000-0x0000000007F61000-memory.dmp
memory/916-37-0x0000000009560000-0x0000000009561000-memory.dmp
memory/916-38-0x0000000009930000-0x0000000009931000-memory.dmp
memory/916-29-0x0000000007790000-0x0000000007791000-memory.dmp
memory/916-28-0x00000000078D0000-0x00000000078D1000-memory.dmp
memory/916-39-0x00000000073E0000-0x00000000073E1000-memory.dmp
memory/916-27-0x0000000004D10000-0x0000000004D11000-memory.dmp
memory/916-26-0x0000000073580000-0x0000000073C6E000-memory.dmp
memory/3344-21-0x0000000005270000-0x0000000005271000-memory.dmp
memory/3344-12-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/3344-20-0x0000000005180000-0x00000000051F1000-memory.dmp
memory/3344-15-0x0000000073500000-0x0000000073BEE000-memory.dmp
memory/3608-7-0x0000000005470000-0x0000000005478000-memory.dmp
memory/3608-0-0x0000000073500000-0x0000000073BEE000-memory.dmp
memory/3608-9-0x000000000B5A0000-0x000000000B653000-memory.dmp
memory/3608-8-0x0000000008D80000-0x0000000008E34000-memory.dmp
memory/3608-6-0x0000000008740000-0x0000000008741000-memory.dmp
memory/3608-5-0x0000000005220000-0x0000000005221000-memory.dmp
memory/3608-4-0x0000000005270000-0x0000000005271000-memory.dmp
memory/3608-3-0x0000000005870000-0x0000000005871000-memory.dmp
memory/3608-1-0x00000000008E0000-0x00000000008E1000-memory.dmp