Analysis
- max time kernel
148s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
15/11/2020, 23:20
General
- Target da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe
- Size 221KB
- Sample201115-egha5fmy5e
- SHA256 da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 26 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 95 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe"C:\Users\Admin\AppData\Local\Temp\da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PlayToDevice32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PlayToDevice32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PlayToDevice32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe" && del "C:\Users\Admin\AppData\Local\Temp\da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe.config"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PlayToDevice32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PlayToDevice32.exe arguments1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PlayToDevice32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PlayToDevice32.exe arguments1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/200-235-0x00007FF820810000-0x00007FF8211B0000-memory.dmp
memory/1628-0-0x00007FF820810000-0x00007FF8211B0000-memory.dmp
memory/3148-119-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-39-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-124-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-13-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-14-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-15-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-16-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-17-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-18-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-19-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-20-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-21-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-22-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-23-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-24-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-25-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-26-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-27-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-126-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-29-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-30-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-31-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-32-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-33-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-34-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-35-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-36-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-37-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-38-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-125-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-40-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-41-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-42-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-43-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-44-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-45-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-47-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-46-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-48-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-50-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-49-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-51-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-53-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-52-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-54-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-55-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-56-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-57-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-58-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-59-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-60-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-61-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-62-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-63-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-64-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-65-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-66-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-67-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-68-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-69-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-71-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-70-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-72-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-73-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-74-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-75-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-76-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-77-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-78-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-79-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-86-0x0000000021580000-0x0000000021581000-memory.dmp
memory/3148-87-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-88-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-89-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-90-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-91-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-92-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-93-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-94-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-95-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-96-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-97-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-98-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-99-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-100-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-101-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-103-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-102-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-104-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-105-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-106-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-107-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-108-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-109-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-110-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-111-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-112-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-113-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-114-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-115-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-116-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-117-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-118-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-10-0x0000000021480000-0x0000000021481000-memory.dmp
memory/3148-120-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-121-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-122-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-123-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-11-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-12-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-28-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-127-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-128-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-129-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-130-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-131-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-133-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-132-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-134-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-135-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-136-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-137-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-138-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-139-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-140-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-141-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-142-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-143-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-144-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-145-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-146-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-147-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-148-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-149-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-150-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-151-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-152-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-153-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-154-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-155-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-160-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-161-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-162-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-163-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-164-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-165-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-166-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-167-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-168-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-169-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-170-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-171-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-172-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-173-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-174-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-175-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-176-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-177-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-178-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-179-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-180-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-181-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-182-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-183-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-185-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-184-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-186-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-187-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-188-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-189-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-190-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-191-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-193-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-192-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-194-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-195-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-196-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-197-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-198-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-200-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-199-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-201-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-202-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-203-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-204-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-205-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-206-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-208-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-207-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-209-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-210-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-211-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-212-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-213-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-215-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-214-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-216-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-217-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-218-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-219-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-220-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-221-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-223-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-222-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-224-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-225-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-226-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-227-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-228-0x0000000020E00000-0x0000000020E1C000-memory.dmp
memory/3148-232-0x0000000021580000-0x0000000021581000-memory.dmp
memory/3148-233-0x0000000021780000-0x0000000021781000-memory.dmp
memory/3148-5-0x00007FF820810000-0x00007FF8211B0000-memory.dmp
memory/3896-238-0x00007FF820810000-0x00007FF8211B0000-memory.dmp