Analysis

  • max time kernel
    116s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    14-01-2021 07:03

General

  • Target

    PO17440.exe

  • Size

    808KB

  • MD5

    7103361102baaf605a06ac135b1a9599

  • SHA1

    3baf4ece5dbe3d28cfc3aafabbf45c4dbe5ca13e

  • SHA256

    ea5a29bc3a13bb5db5c28571a756b1d186c3032c573df2cc61c095dfe7bc5066

  • SHA512

    2099377e9eeb2e1ebe18582a76b8457ebdf3efffb364ee65b229e04885a77c08ecc35a87a2ccdf316abd35a54183cb5da8d3b6da2a2c9be0f925f0819662f7af

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO17440.exe
    "C:\Users\Admin\AppData\Local\Temp\PO17440.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:732
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NOXJzvNvvjpae" /XML "C:\Users\Admin\AppData\Local\Temp\tmp694A.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1940
    • C:\Users\Admin\AppData\Local\Temp\PO17440.exe
      "{path}"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1336

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO17440.exe.log
    MD5

    0c2899d7c6746f42d5bbe088c777f94c

    SHA1

    622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

    SHA256

    5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

    SHA512

    ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

  • C:\Users\Admin\AppData\Local\Temp\tmp694A.tmp
    MD5

    4c767c35ab89ffeac276c4c14308eb12

    SHA1

    2eaa829172501ab46cb0279c0efe6d4d810b3aea

    SHA256

    4b4298b3daba95590cbbac39e39c9bc23f095067180fbc741bc1c4b3655c5290

    SHA512

    409684b751b84f1168d6106392e328af7b3ddddbe8e344231a590feeec1d7bd40fac5d5f932cdec39f4e8b2acd647133ca4607b6a1fe5d5b3fc00d1c5ef276c0

  • memory/732-7-0x0000000002C30000-0x0000000002C31000-memory.dmp
    Filesize

    4KB

  • memory/732-5-0x0000000005740000-0x0000000005741000-memory.dmp
    Filesize

    4KB

  • memory/732-2-0x00000000730E0000-0x00000000737CE000-memory.dmp
    Filesize

    6.9MB

  • memory/732-8-0x0000000005220000-0x000000000522E000-memory.dmp
    Filesize

    56KB

  • memory/732-9-0x0000000007580000-0x0000000007614000-memory.dmp
    Filesize

    592KB

  • memory/732-10-0x00000000076C0000-0x00000000076C1000-memory.dmp
    Filesize

    4KB

  • memory/732-3-0x0000000000790000-0x0000000000791000-memory.dmp
    Filesize

    4KB

  • memory/732-6-0x00000000050B0000-0x00000000050B1000-memory.dmp
    Filesize

    4KB

  • memory/1336-13-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

  • memory/1336-14-0x000000000043774E-mapping.dmp
  • memory/1336-16-0x00000000730E0000-0x00000000737CE000-memory.dmp
    Filesize

    6.9MB

  • memory/1336-21-0x0000000005490000-0x0000000005491000-memory.dmp
    Filesize

    4KB

  • memory/1336-22-0x0000000005D70000-0x0000000005D71000-memory.dmp
    Filesize

    4KB

  • memory/1940-11-0x0000000000000000-mapping.dmp