Analysis
-
max time kernel
56s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-01-2021 07:43
Static task
static1
Behavioral task
behavioral1
Sample
20210113155320.exe
Resource
win7v20201028
General
-
Target
20210113155320.exe
-
Size
1.0MB
-
MD5
0f44dd4d1edea35e84e0d2495ac90b5b
-
SHA1
656e86e7556720bb16c0b8d760b87b0520ed8f20
-
SHA256
38dac51ef91ec8f45bdb2749e2eec758b07e7b9855f2b9b25d2e59783ba9ff41
-
SHA512
c8aef460935dd1cd8413648be5a7ed7ddffd9204a5bb38c558816274ccd350d9ab892e5c3884bf75bacb9036cb46ebe2108c86d1e2c66cab39d807defc541e5f
Malware Config
Signatures
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
20210113155320.exepid process 1696 20210113155320.exe 1696 20210113155320.exe 1696 20210113155320.exe 1696 20210113155320.exe 1696 20210113155320.exe 1696 20210113155320.exe 1696 20210113155320.exe 1696 20210113155320.exe 1696 20210113155320.exe 1696 20210113155320.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
20210113155320.exedescription pid process Token: SeDebugPrivilege 1696 20210113155320.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
20210113155320.exedescription pid process target process PID 1696 wrote to memory of 1372 1696 20210113155320.exe schtasks.exe PID 1696 wrote to memory of 1372 1696 20210113155320.exe schtasks.exe PID 1696 wrote to memory of 1372 1696 20210113155320.exe schtasks.exe PID 1696 wrote to memory of 1372 1696 20210113155320.exe schtasks.exe PID 1696 wrote to memory of 1536 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 1536 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 1536 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 1536 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 1640 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 1640 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 1640 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 1640 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 1692 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 1692 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 1692 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 1692 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 1680 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 1680 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 1680 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 1680 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 736 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 736 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 736 1696 20210113155320.exe 20210113155320.exe PID 1696 wrote to memory of 736 1696 20210113155320.exe 20210113155320.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20210113155320.exe"C:\Users\Admin\AppData\Local\Temp\20210113155320.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OKKTFu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3C8.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\20210113155320.exe"C:\Users\Admin\AppData\Local\Temp\20210113155320.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\20210113155320.exe"C:\Users\Admin\AppData\Local\Temp\20210113155320.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\20210113155320.exe"C:\Users\Admin\AppData\Local\Temp\20210113155320.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\20210113155320.exe"C:\Users\Admin\AppData\Local\Temp\20210113155320.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\20210113155320.exe"C:\Users\Admin\AppData\Local\Temp\20210113155320.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3C8.tmpMD5
c3a6efb60428d7cb2cb80dd57cc62bde
SHA134a2e633e49bef737bc0fa4fb253903e56614eed
SHA256e6c15aad3a800b7c5baeb5f00b47931e4b37e6a66446acb59ec1c39e7aa6a67e
SHA51211b5749255f664dc2861dd519ece14c98a8f6fdd0ffd24ee2e0eb4ca170f23727596de03a5a3c5622800467344d2cf0b89c2f98d574c8af51bd793d33fdda26d
-
memory/1372-7-0x0000000000000000-mapping.dmp
-
memory/1696-2-0x0000000074D20000-0x000000007540E000-memory.dmpFilesize
6.9MB
-
memory/1696-3-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/1696-5-0x0000000000310000-0x0000000000322000-memory.dmpFilesize
72KB
-
memory/1696-6-0x00000000052C0000-0x000000000532B000-memory.dmpFilesize
428KB