Analysis
- max time kernel
150s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/11/2020, 11:33
General
- Target d5bcd52402cd0e4a4b2866fe618200dde5ff24126ba06fae5d0c56a0c4920970.exe
- Size 222KB
- Sample201111-bjvhpynx7a
- SHA256 d5bcd52402cd0e4a4b2866fe618200dde5ff24126ba06fae5d0c56a0c4920970
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 26 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 97 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5bcd52402cd0e4a4b2866fe618200dde5ff24126ba06fae5d0c56a0c4920970.exe"C:\Users\Admin\AppData\Local\Temp\d5bcd52402cd0e4a4b2866fe618200dde5ff24126ba06fae5d0c56a0c4920970.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\mfc100jpn32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\mfc100jpn32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\mfc100jpn32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\d5bcd52402cd0e4a4b2866fe618200dde5ff24126ba06fae5d0c56a0c4920970.exe" && del "C:\Users\Admin\AppData\Local\Temp\d5bcd52402cd0e4a4b2866fe618200dde5ff24126ba06fae5d0c56a0c4920970.exe.config"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\mfc100jpn32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\mfc100jpn32.exe arguments1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\mfc100jpn32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\mfc100jpn32.exe arguments1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/652-89-0x00007FFA6B350000-0x00007FFA6BCF0000-memory.dmp
memory/884-0-0x00007FFA6B350000-0x00007FFA6BCF0000-memory.dmp
memory/908-49-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-56-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-16-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-17-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-18-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-19-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-20-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-21-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-22-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-23-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-24-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-25-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-26-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-27-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-28-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-29-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-52-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-31-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-32-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-33-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-34-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-35-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-36-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-37-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-54-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-38-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-40-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-42-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-41-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-43-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-44-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-46-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-45-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-47-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-48-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-50-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-51-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-30-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-15-0x0000000020F40000-0x0000000020F41000-memory.dmp
memory/908-39-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-53-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-55-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-57-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-58-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-59-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-60-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-61-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-62-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-63-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-64-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-65-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-66-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-68-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-67-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-69-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-70-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-71-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-72-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-73-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-74-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-75-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-76-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-78-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-77-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-79-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-80-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-81-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-82-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-83-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-84-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-85-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-86-0x0000000020760000-0x000000002077C000-memory.dmp
memory/908-14-0x0000000020C40000-0x0000000020C41000-memory.dmp
memory/908-10-0x0000000020C40000-0x0000000020C41000-memory.dmp
memory/908-5-0x00007FFA6B350000-0x00007FFA6BCF0000-memory.dmp
memory/3828-92-0x00007FFA6B350000-0x00007FFA6BCF0000-memory.dmp