d7f3cc72163e809b398c83abb04b237d3f900fee8886e862995a2e5995c3d627

Analysis

max time kernel
114s
max time network
119s
platform
windows10_x64
resource
win10
submitted
30/09/2020, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC070920.exe
Size 457KB
Sample200930-hlx5s8jdce
SHA256 d7f3cc72163e809b398c83abb04b237d3f900fee8886e862995a2e5995c3d627
MD5 e06f874f07220c99d1052dbfdd3f7abf
SHA1 056dd4092069b7e039fbb0d041474ca21573fc47
SHA512 e0419af7888f970c4eaf5dde7c693c87f65a0950bf4e624aad99053dac2e8c06f748e372d18e71a762cfb221950939a62fb34d01b6e05dc3b2472be3aa08ff1b
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3920 set thread context of 2240	3920	DOC070920.exe	79

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3920	DOC070920.exe
3920	DOC070920.exe
3920	DOC070920.exe
2240	DOC070920.exe
2240	DOC070920.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3920	DOC070920.exe
Token: SeDebugPrivilege	2240	DOC070920.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 2040	3920	DOC070920.exe	76
PID 3920 wrote to memory of 2040	3920	DOC070920.exe	76
PID 3920 wrote to memory of 2040	3920	DOC070920.exe	76
PID 3920 wrote to memory of 2216	3920	DOC070920.exe	78
PID 3920 wrote to memory of 2216	3920	DOC070920.exe	78
PID 3920 wrote to memory of 2216	3920	DOC070920.exe	78
PID 3920 wrote to memory of 2240	3920	DOC070920.exe	79
PID 3920 wrote to memory of 2240	3920	DOC070920.exe	79
PID 3920 wrote to memory of 2240	3920	DOC070920.exe	79
PID 3920 wrote to memory of 2240	3920	DOC070920.exe	79
PID 3920 wrote to memory of 2240	3920	DOC070920.exe	79
PID 3920 wrote to memory of 2240	3920	DOC070920.exe	79
PID 3920 wrote to memory of 2240	3920	DOC070920.exe	79
PID 3920 wrote to memory of 2240	3920	DOC070920.exe	79

C:\Users\Admin\AppData\Local\Temp\DOC070920.exe
"C:\Users\Admin\AppData\Local\Temp\DOC070920.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\meuxKIe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBE8.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2040
- C:\Users\Admin\AppData\Local\Temp\DOC070920.exe
  "C:\Users\Admin\AppData\Local\Temp\DOC070920.exe"
  2⤵
  PID:2216
- C:\Users\Admin\AppData\Local\Temp\DOC070920.exe
  "C:\Users\Admin\AppData\Local\Temp\DOC070920.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-22-0x0000000006450000-0x0000000006451000-memory.dmp

Download

memory/2240-21-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

Download

memory/2240-16-0x0000000073580000-0x0000000073C6E000-memory.dmp

Download

memory/2240-13-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3920-5-0x0000000004A50000-0x0000000004A51000-memory.dmp

Download

memory/3920-10-0x0000000005900000-0x000000000593B000-memory.dmp

Download

memory/3920-9-0x00000000058A0000-0x00000000058F7000-memory.dmp

Download

memory/3920-8-0x0000000004910000-0x0000000004913000-memory.dmp

Download

memory/3920-7-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Download

memory/3920-6-0x00000000023A0000-0x00000000023A1000-memory.dmp

Download

memory/3920-0-0x0000000073580000-0x0000000073C6E000-memory.dmp

Download

memory/3920-4-0x0000000004F50000-0x0000000004F51000-memory.dmp

Download

memory/3920-3-0x00000000049B0000-0x00000000049B1000-memory.dmp

Download

memory/3920-1-0x0000000000050000-0x0000000000051000-memory.dmp

Download