44de8368a07efe44888bfe4b83a307c6002a0c4202a02150d884248c8b8ae75d

Analysis

max time kernel
110s
max time network
112s
platform
windows10_x64
resource
win10v200722
submitted
15/10/2020, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Products.exe
Size 573KB
Sample201015-kac6f4e3k2
SHA256 44de8368a07efe44888bfe4b83a307c6002a0c4202a02150d884248c8b8ae75d
MD5 136e01505c317fc1cea9119aa69bff14
SHA1 5d2660b9016370ce9ef1db15820eec44c649de5d
SHA512 455e9dbf9b83f5d79d4b0a4a88c66636ed10e65bdc782414a134d2a3044f73b61b9a1aa573770f6a8496510831677067c0257daffe23f703500f2b2a80f6b003
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2584 set thread context of 3188	2584	Products.exe	77

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3188	Products.exe
3188	Products.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3188	Products.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 776	2584	Products.exe	75
PID 2584 wrote to memory of 776	2584	Products.exe	75
PID 2584 wrote to memory of 776	2584	Products.exe	75
PID 2584 wrote to memory of 3188	2584	Products.exe	77
PID 2584 wrote to memory of 3188	2584	Products.exe	77
PID 2584 wrote to memory of 3188	2584	Products.exe	77
PID 2584 wrote to memory of 3188	2584	Products.exe	77
PID 2584 wrote to memory of 3188	2584	Products.exe	77
PID 2584 wrote to memory of 3188	2584	Products.exe	77
PID 2584 wrote to memory of 3188	2584	Products.exe	77
PID 2584 wrote to memory of 3188	2584	Products.exe	77

C:\Users\Admin\AppData\Local\Temp\Products.exe
"C:\Users\Admin\AppData\Local\Temp\Products.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XWByxUKieVzKy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA7BA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:776
- C:\Users\Admin\AppData\Local\Temp\Products.exe
  "C:\Users\Admin\AppData\Local\Temp\Products.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-9-0x00000000063D0000-0x0000000006408000-memory.dmp

Download

memory/2584-3-0x0000000005A10000-0x0000000005A11000-memory.dmp

Download

memory/2584-6-0x0000000005570000-0x0000000005571000-memory.dmp

Download

memory/2584-7-0x0000000005560000-0x000000000556B000-memory.dmp

Download

memory/2584-8-0x0000000006360000-0x00000000063CD000-memory.dmp

Download

memory/2584-0-0x0000000073940000-0x000000007402E000-memory.dmp

Download

memory/2584-4-0x00000000055B0000-0x00000000055B1000-memory.dmp

Download

memory/2584-5-0x0000000005650000-0x0000000005651000-memory.dmp

Download

memory/2584-1-0x0000000000B70000-0x0000000000B71000-memory.dmp

Download

memory/3188-12-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3188-15-0x0000000073940000-0x000000007402E000-memory.dmp

Download

memory/3188-20-0x0000000005580000-0x0000000005581000-memory.dmp

Download

memory/3188-21-0x00000000060E0000-0x00000000060E1000-memory.dmp

Download