Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    14-01-2021 07:03

General

  • Target

    PO17440.exe

  • Size

    808KB

  • MD5

    7103361102baaf605a06ac135b1a9599

  • SHA1

    3baf4ece5dbe3d28cfc3aafabbf45c4dbe5ca13e

  • SHA256

    ea5a29bc3a13bb5db5c28571a756b1d186c3032c573df2cc61c095dfe7bc5066

  • SHA512

    2099377e9eeb2e1ebe18582a76b8457ebdf3efffb364ee65b229e04885a77c08ecc35a87a2ccdf316abd35a54183cb5da8d3b6da2a2c9be0f925f0819662f7af

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO17440.exe
    "C:\Users\Admin\AppData\Local\Temp\PO17440.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NOXJzvNvvjpae" /XML "C:\Users\Admin\AppData\Local\Temp\tmp30E0.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1744
    • C:\Users\Admin\AppData\Local\Temp\PO17440.exe
      "{path}"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1500

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp30E0.tmp
    MD5

    33e53e349b5170e6101d56363e7d1c70

    SHA1

    8dec6f5719b5dc89d5831b8188a1a59badb35c85

    SHA256

    4570a6088e9bfd2697280a68c344bcc69d546940e2ea14972475e3dd87640d18

    SHA512

    cc9a9a50f2aa7cb25bf17b5174f44a72af8251b5cc4396d6b21224c919e24c70d644463d4df6d94465d1a94b068425bd1fd20b380e51829a63264bf0516673de

  • memory/744-2-0x0000000073FF0000-0x00000000746DE000-memory.dmp
    Filesize

    6.9MB

  • memory/744-3-0x0000000000B20000-0x0000000000B21000-memory.dmp
    Filesize

    4KB

  • memory/744-5-0x0000000000540000-0x000000000054E000-memory.dmp
    Filesize

    56KB

  • memory/744-6-0x0000000005600000-0x0000000005694000-memory.dmp
    Filesize

    592KB

  • memory/1500-9-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

  • memory/1500-10-0x000000000043774E-mapping.dmp
  • memory/1500-11-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

  • memory/1500-12-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

  • memory/1500-13-0x0000000073FF0000-0x00000000746DE000-memory.dmp
    Filesize

    6.9MB

  • memory/1744-7-0x0000000000000000-mapping.dmp