Analysis
- max time kernel
134s - max time network
136s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 19:58
General
- Target INV.exe
- Size 175KB
- Sample201109-v94c99a7gn
- SHA256 aa025c5073c737b73d42bc9295b7622e9c0b2db8a7bb9f480ba45a76a18259f3
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV.exe"C:\Users\Admin\AppData\Local\Temp\INV.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn rPPsXc0ppjyUHal6Aib.exe /tr C:\Users\Admin\AppData\Roaming\rPPsXc0ppjyUHal6Aib.exe2⤵
- Creates scheduled task(s)
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {1F1C18D5-A6E0-4B52-A494-49987F2C3D7B} S-1-5-21-293278959-2699126792-324916226-1000:TUICJFPF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\rPPsXc0ppjyUHal6Aib.exeC:\Users\Admin\AppData\Roaming\rPPsXc0ppjyUHal6Aib.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\rPPsXc0ppjyUHal6Aib.exeC:\Users\Admin\AppData\Roaming\rPPsXc0ppjyUHal6Aib.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\rPPsXc0ppjyUHal6Aib.exeC:\Users\Admin\AppData\Roaming\rPPsXc0ppjyUHal6Aib.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/960-36-0x0000000000130000-0x0000000000131000-memory.dmp
memory/960-35-0x0000000073760000-0x0000000073E4E000-memory.dmp
memory/1688-18-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/1688-17-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
memory/1688-12-0x0000000004720000-0x0000000004721000-memory.dmp
memory/1688-13-0x00000000006B0000-0x00000000006B1000-memory.dmp
memory/1688-14-0x00000000047F0000-0x00000000047F1000-memory.dmp
memory/1688-15-0x00000000006F0000-0x00000000006F1000-memory.dmp
memory/1688-16-0x0000000000730000-0x0000000000731000-memory.dmp
memory/1688-8-0x0000000000070000-0x0000000000071000-memory.dmp
memory/1688-11-0x0000000000540000-0x0000000000541000-memory.dmp
memory/1688-7-0x0000000073760000-0x0000000073E4E000-memory.dmp
memory/1688-10-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/1916-1-0x00000000002D0000-0x00000000002D1000-memory.dmp
memory/1916-0-0x0000000074480000-0x0000000074B6E000-memory.dmp
memory/1972-24-0x0000000004C90000-0x0000000004C91000-memory.dmp
memory/1972-26-0x0000000005260000-0x0000000005261000-memory.dmp
memory/1972-27-0x0000000000830000-0x0000000000831000-memory.dmp
memory/1972-28-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
memory/1972-29-0x0000000000B10000-0x0000000000B11000-memory.dmp
memory/1972-30-0x0000000000B40000-0x0000000000B41000-memory.dmp
memory/1972-31-0x0000000000D20000-0x0000000000D21000-memory.dmp
memory/1972-32-0x0000000000BB0000-0x0000000000BB1000-memory.dmp
memory/1972-25-0x0000000000470000-0x0000000000471000-memory.dmp
memory/1972-22-0x0000000000B60000-0x0000000000B61000-memory.dmp
memory/1972-21-0x0000000074480000-0x0000000074B6E000-memory.dmp