450f7d91e80c562310d464e2d0cebaa1ca6e0c475b29dda096fdeee69343701d

General

Target

Booking.exe
Size

760KB
MD5

be4013ed4e9fc8135904614cc4cba168
SHA1

bdebf68b92cc39ed4c6013f69dafefcdd09385d3
SHA256

450f7d91e80c562310d464e2d0cebaa1ca6e0c475b29dda096fdeee69343701d
SHA512

c0702434f0888e19a281412ce69eaec88b5cef8a0b551071e0ddf3c6e47113319e69ee0b2c303db2c3b5e19ec85189e21b2daca8a2fc661063f4c25141282861

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

Booking.exe

description pid process target process

PID 4048 set thread context of 2652 4048 Booking.exe Booking.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4040 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Booking.exe

pid process

2652 Booking.exe
2652 Booking.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Booking.exe

description pid process

Token: SeDebugPrivilege 2652 Booking.exe

description	pid	process	target process
PID 4048 set thread context of 2652	4048	Booking.exe	Booking.exe

pid	process
4040	schtasks.exe

pid	process
2652	Booking.exe
2652	Booking.exe

description	pid	process
Token: SeDebugPrivilege	2652	Booking.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Booking.exe

description	pid	process	target process
PID 4048 wrote to memory of 4040	4048	Booking.exe	schtasks.exe
PID 4048 wrote to memory of 4040	4048	Booking.exe	schtasks.exe
PID 4048 wrote to memory of 4040	4048	Booking.exe	schtasks.exe
PID 4048 wrote to memory of 2652	4048	Booking.exe	Booking.exe
PID 4048 wrote to memory of 2652	4048	Booking.exe	Booking.exe
PID 4048 wrote to memory of 2652	4048	Booking.exe	Booking.exe
PID 4048 wrote to memory of 2652	4048	Booking.exe	Booking.exe
PID 4048 wrote to memory of 2652	4048	Booking.exe	Booking.exe
PID 4048 wrote to memory of 2652	4048	Booking.exe	Booking.exe
PID 4048 wrote to memory of 2652	4048	Booking.exe	Booking.exe
PID 4048 wrote to memory of 2652	4048	Booking.exe	Booking.exe

C:\Users\Admin\AppData\Local\Temp\Booking.exe
"C:\Users\Admin\AppData\Local\Temp\Booking.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4048

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TvNoaLvRBhpKuQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp996.tmp"
2⤵
- Creates scheduled task(s)
PID:4040

C:\Users\Admin\AppData\Local\Temp\Booking.exe
"C:\Users\Admin\AppData\Local\Temp\Booking.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Booking.exe.log
MD5
90acfd72f14a512712b1a7380c0faf60

SHA1
40ba4accb8faa75887e84fb8e38d598dc8cf0f12

SHA256
20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

SHA512
29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp996.tmp
MD5
4a6f3d907f9c856fe69db2d054a5528f

SHA1
8f480a5622fb551a5685156a0157fc023bf9ae9b

SHA256
622ee38b2bea914e2e03e0064df86f82d0ce1f61aaa2f35cc05b49faf04e82dc

SHA512
b3bba72e5b68f58e53ff484cd5ba0e876dda1ffbe531609088ec9ccab33872f099ab15873517bab5fd7fd290007ea01fcca9b1c06a5dd755ab2b5224392d469e

Download Submit
memory/2652-23-0x00000000064A0000-0x00000000064A1000-memory.dmp

Filesize
4KB

Download
memory/2652-22-0x0000000005F00000-0x0000000005F01000-memory.dmp

Filesize
4KB

Download
memory/2652-17-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2652-14-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-15-0x000000000043764E-mapping.dmp

Download
memory/4040-12-0x0000000000000000-mapping.dmp

Download
memory/4048-7-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/4048-11-0x0000000005CB0000-0x0000000005D2A000-memory.dmp

Filesize
488KB

Download
memory/4048-10-0x0000000004F60000-0x0000000004F72000-memory.dmp

Filesize
72KB

Download
memory/4048-9-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download
memory/4048-8-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/4048-2-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/4048-6-0x0000000005530000-0x0000000005531000-memory.dmp

Filesize
4KB

Download
memory/4048-5-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/4048-3-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads