299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a

General

Target

299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe
Size

1.1MB
MD5

eaac66f1ed8fc1a960ae866012cf6437
SHA1

d7f91b80a7fd68240320fd69f43853c73878927e
SHA256

299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a
SHA512

0d8a0301601e9ba484649a9dddea61b091631820503b8e7069a61122adb09160db909a9361387256552e6a29ad6890571117fa9d48b12fcce7b6cf03bb28bbf9

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe

description	pid	process	target process
PID 1104 set thread context of 3228	1104	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2768 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe

pid process

1104 299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe

description pid process

Token: SeDebugPrivilege 1104 299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe

pid	process
2768	schtasks.exe

pid	process
1104	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe

description	pid	process
Token: SeDebugPrivilege	1104	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe

description	pid	process	target process
PID 1104 wrote to memory of 2768	1104	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe	schtasks.exe
PID 1104 wrote to memory of 2768	1104	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe	schtasks.exe
PID 1104 wrote to memory of 2768	1104	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe	schtasks.exe
PID 1104 wrote to memory of 3228	1104	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe
PID 1104 wrote to memory of 3228	1104	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe
PID 1104 wrote to memory of 3228	1104	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe
PID 1104 wrote to memory of 3228	1104	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe
PID 1104 wrote to memory of 3228	1104	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe
PID 1104 wrote to memory of 3228	1104	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe
PID 1104 wrote to memory of 3228	1104	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe
PID 1104 wrote to memory of 3228	1104	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe
PID 1104 wrote to memory of 3228	1104	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe	299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe

C:\Users\Admin\AppData\Local\Temp\299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe
"C:\Users\Admin\AppData\Local\Temp\299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eLQuoCLxGvR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA672.tmp"
2⤵
- Creates scheduled task(s)
PID:2768

C:\Users\Admin\AppData\Local\Temp\299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe
"C:\Users\Admin\AppData\Local\Temp\299ff43465ed213c038adf7cde8c57df986b6267dfbb5599ca6925d1bf95f35a.exe"
2⤵
PID:3228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA672.tmp
MD5
216e7ca6025a8927e2280d3df40fa7d1

SHA1
d1a846e34a0889a5b29daf1da36b03e0b216930e

SHA256
f5319adfd71d5d490bfd7b65c591201692551bf2a5253ee4e6a3c76278535015

SHA512
15e495d5906a5db87cc318b2752c48ecf0a252002308322aed830935f1aa4c0ac432b866496f09d3db817573ac09a9f0954bebcb775bcecae260150ce65fa3b4

Download Submit
memory/1104-5-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/1104-10-0x0000000005E20000-0x0000000005EC7000-memory.dmp

Filesize
668KB

Download
memory/1104-4-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/1104-0-0x0000000073A80000-0x000000007416E000-memory.dmp

Filesize
6.9MB

Download
memory/1104-6-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/1104-7-0x0000000005180000-0x0000000005181000-memory.dmp

Filesize
4KB

Download
memory/1104-3-0x0000000004F70000-0x0000000004F71000-memory.dmp

Filesize
4KB

Download
memory/1104-9-0x0000000005080000-0x0000000005084000-memory.dmp

Filesize
16KB

Download
memory/1104-8-0x0000000005380000-0x0000000005381000-memory.dmp

Filesize
4KB

Download
memory/1104-11-0x0000000005ED0000-0x0000000005F62000-memory.dmp

Filesize
584KB

Download
memory/1104-1-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2768-12-0x0000000000000000-mapping.dmp

Download
memory/3228-14-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3228-15-0x000000000043FA98-mapping.dmp

Download
memory/3228-16-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads