4d302b4fd8564f5e3f9b505c0f342ec0e133fca6e5d0c6b3bd89746351561c5b

Analysis

max time kernel
63s
max time network
11s
platform
windows7_x64
resource
win7v20201028
submitted
17/12/2020, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pay-u Forms.scr
Size 329KB
Sample201217-9lr4ssxylx
SHA256 4d302b4fd8564f5e3f9b505c0f342ec0e133fca6e5d0c6b3bd89746351561c5b
MD5 68d0d379c53e2109ec75b26fc7b513e4
SHA1 759faa356670e1349c4775604621771a40a533c5
SHA512 45c1d26145ef47cfb79162142c2879817b78bc6656f89061b129a0a72254be1a66ad945ac72032f948037421d5e7e1f18f580fa03ab6ef1448d6b2b8fe9f5432
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1628	schtasks.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 896	1204	Pay-u Forms.scr	30
PID 1204 wrote to memory of 896	1204	Pay-u Forms.scr	30
PID 1204 wrote to memory of 896	1204	Pay-u Forms.scr	30
PID 1204 wrote to memory of 896	1204	Pay-u Forms.scr	30
PID 1204 wrote to memory of 1376	1204	Pay-u Forms.scr	31
PID 1204 wrote to memory of 1376	1204	Pay-u Forms.scr	31
PID 1204 wrote to memory of 1376	1204	Pay-u Forms.scr	31
PID 1204 wrote to memory of 1376	1204	Pay-u Forms.scr	31
PID 896 wrote to memory of 1628	896	cmd.exe	32
PID 896 wrote to memory of 1628	896	cmd.exe	32
PID 896 wrote to memory of 1628	896	cmd.exe	32
PID 896 wrote to memory of 1628	896	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\Pay-u Forms.scr
"C:\Users\Admin\AppData\Local\Temp\Pay-u Forms.scr" /S
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\5f4378c5c37745f2adbac23327ae1350.xml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\5f4378c5c37745f2adbac23327ae1350.xml"
    3⤵
    - Creates scheduled task(s)
    PID:1628
- C:\Users\Admin\AppData\Local\Temp\Pay-u Forms.scr
  "C:\Users\Admin\AppData\Local\Temp\Pay-u Forms.scr"
  2⤵
  PID:1376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads