6ea11326c3a5f1868bc3e68659b48bc00a0ac1eaa5941d40c0d0c42c039aad85

Analysis

max time kernel
146s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
06/11/2020, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MO 48812 1046098_Docx.exe
Size 584KB
Sample201106-v6xtsnpxhx
SHA256 6ea11326c3a5f1868bc3e68659b48bc00a0ac1eaa5941d40c0d0c42c039aad85
MD5 93b3359513ff91d78d4943f35cba7087
SHA1 4c9f43647e640439a1c0655c03c9e217efe7a73f
SHA512 135dfd800aae95709f58ccfc465b44a16ce109b9c2b0c5b3bcd1a29f9ead23fa4a7543ca897fa66fe60934c4a6e38259116123f505071b160c340f5bbe763a04
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 428 set thread context of 3520	428	MO 48812 1046098_Docx.exe	81

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3520	MO 48812 1046098_Docx.exe
3520	MO 48812 1046098_Docx.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	MO 48812 1046098_Docx.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 1008	428	MO 48812 1046098_Docx.exe	79
PID 428 wrote to memory of 1008	428	MO 48812 1046098_Docx.exe	79
PID 428 wrote to memory of 1008	428	MO 48812 1046098_Docx.exe	79
PID 428 wrote to memory of 3520	428	MO 48812 1046098_Docx.exe	81
PID 428 wrote to memory of 3520	428	MO 48812 1046098_Docx.exe	81
PID 428 wrote to memory of 3520	428	MO 48812 1046098_Docx.exe	81
PID 428 wrote to memory of 3520	428	MO 48812 1046098_Docx.exe	81
PID 428 wrote to memory of 3520	428	MO 48812 1046098_Docx.exe	81
PID 428 wrote to memory of 3520	428	MO 48812 1046098_Docx.exe	81
PID 428 wrote to memory of 3520	428	MO 48812 1046098_Docx.exe	81
PID 428 wrote to memory of 3520	428	MO 48812 1046098_Docx.exe	81

C:\Users\Admin\AppData\Local\Temp\MO 48812 1046098_Docx.exe
"C:\Users\Admin\AppData\Local\Temp\MO 48812 1046098_Docx.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wNLCpSnbEsmRmk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA4D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1008
- C:\Users\Admin\AppData\Local\Temp\MO 48812 1046098_Docx.exe
  "C:\Users\Admin\AppData\Local\Temp\MO 48812 1046098_Docx.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/428-9-0x00000000058F0000-0x000000000595E000-memory.dmp

Download

memory/428-1-0x0000000000A00000-0x0000000000A01000-memory.dmp

Download

memory/428-4-0x00000000059F0000-0x00000000059F1000-memory.dmp

Download

memory/428-5-0x0000000005590000-0x0000000005591000-memory.dmp

Download

memory/428-6-0x00000000053E0000-0x00000000053E1000-memory.dmp

Download

memory/428-7-0x00000000056F0000-0x00000000056F1000-memory.dmp

Download

memory/428-3-0x0000000005410000-0x0000000005411000-memory.dmp

Download

memory/428-8-0x0000000005400000-0x000000000540B000-memory.dmp

Download

memory/428-10-0x00000000059A0000-0x00000000059D9000-memory.dmp

Download

memory/428-0-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/3520-13-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3520-15-0x0000000073160000-0x000000007384E000-memory.dmp

Download

memory/3520-20-0x0000000004F30000-0x0000000004F31000-memory.dmp

Download

memory/3520-21-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

Download