590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b

General

Target
590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe
Size 881KB
Sample201104-c8et2ewhd6
SHA256 590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b
MD5 6e6c85057b38c1d37c9e5f193fed4198
SHA1 5ef31f8769dd1efc659a2bf49ee53a91454f22c0
SHA512 eaea9c96c4d3b7b1ea7d6d5fd16feb5c048a3c01a1be70a235e8212e07fa7204e26de219128cf8fbd75d7429376ac07f16e93c2d751fee050220f67026555d3b
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\NEWAPP = "C:\\Users\\Admin\\AppData\\Roaming\\NEWAPP\\NEWAPP.exe"	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe

Modifies service 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ASP.NET_4.0.30319\Names\zVGyVWvUTEh4Fo5cGxo4fCn4PZ07l62H4ofuKZLrfVeYRm4JTOMOuxkMn6CtEENum2XkdCSF79Kv15LnYmpZu1ji6e9tFcaaYH7VP9GgWsE0UyLmu5GkC1 = "1992"	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 704	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	33

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe
1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe
1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe
1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe
704	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe
704	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe
Token: SeDebugPrivilege	704	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1824	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	29
PID 1992 wrote to memory of 1824	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	29
PID 1992 wrote to memory of 1824	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	29
PID 1992 wrote to memory of 1824	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	29
PID 1992 wrote to memory of 368	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	31
PID 1992 wrote to memory of 368	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	31
PID 1992 wrote to memory of 368	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	31
PID 1992 wrote to memory of 368	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	31
PID 1992 wrote to memory of 1112	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	32
PID 1992 wrote to memory of 1112	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	32
PID 1992 wrote to memory of 1112	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	32
PID 1992 wrote to memory of 1112	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	32
PID 1992 wrote to memory of 704	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	33
PID 1992 wrote to memory of 704	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	33
PID 1992 wrote to memory of 704	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	33
PID 1992 wrote to memory of 704	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	33
PID 1992 wrote to memory of 704	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	33
PID 1992 wrote to memory of 704	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	33
PID 1992 wrote to memory of 704	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	33
PID 1992 wrote to memory of 704	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	33
PID 1992 wrote to memory of 704	1992	590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe	33

C:\Users\Admin\AppData\Local\Temp\590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe
"C:\Users\Admin\AppData\Local\Temp\590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe"
1⤵
- Modifies service
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hwKWvOxofU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE34.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1824
- C:\Users\Admin\AppData\Local\Temp\590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe
  "{path}"
  2⤵
  PID:368
- C:\Users\Admin\AppData\Local\Temp\590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe
  "{path}"
  2⤵
  PID:1112
- C:\Users\Admin\AppData\Local\Temp\590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:704