cf2cb34e061e0a3d995c8d9910e1f03e63b0c8c848e8a697a3ec8b0cb294e96e

Analysis

max time kernel
160s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
10/02/2022, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f9d5c1cd96f5884fbed96d46be260037.exe
Size 2.0MB
Sample220210-jg24bagcd5
SHA256 cf2cb34e061e0a3d995c8d9910e1f03e63b0c8c848e8a697a3ec8b0cb294e96e
MD5 f9d5c1cd96f5884fbed96d46be260037
SHA1 4df0682355e50dce08d9a43a47b9954d36a2f24b
SHA512 1242e722639a4f88317616da65de95c4108f4225dd178e263e76f02425ebdf15d791f80ff1dd7632053642c79c769c2bc52a33a14cede37c022ee3064bebe5fa
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2844	asjaszsdge.exe
3420	sihost64.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1936	conhost.exe
1932	conhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	conhost.exe
Token: SeDebugPrivilege	1932	conhost.exe
Token: SeShutdownPrivilege	2456	svchost.exe
Token: SeCreatePagefilePrivilege	2456	svchost.exe
Token: SeShutdownPrivilege	2456	svchost.exe
Token: SeCreatePagefilePrivilege	2456	svchost.exe
Token: SeShutdownPrivilege	2456	svchost.exe
Token: SeCreatePagefilePrivilege	2456	svchost.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe
Token: SeSecurityPrivilege	572	TiWorker.exe
Token: SeBackupPrivilege	572	TiWorker.exe
Token: SeRestorePrivilege	572	TiWorker.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1936	2056	f9d5c1cd96f5884fbed96d46be260037.exe	82
PID 2056 wrote to memory of 1936	2056	f9d5c1cd96f5884fbed96d46be260037.exe	82
PID 2056 wrote to memory of 1936	2056	f9d5c1cd96f5884fbed96d46be260037.exe	82
PID 1936 wrote to memory of 884	1936	conhost.exe	85
PID 1936 wrote to memory of 884	1936	conhost.exe	85
PID 884 wrote to memory of 2540	884	cmd.exe	87
PID 884 wrote to memory of 2540	884	cmd.exe	87
PID 1936 wrote to memory of 772	1936	conhost.exe	92
PID 1936 wrote to memory of 772	1936	conhost.exe	92
PID 772 wrote to memory of 2844	772	cmd.exe	94
PID 772 wrote to memory of 2844	772	cmd.exe	94
PID 2844 wrote to memory of 1932	2844	asjaszsdge.exe	95
PID 2844 wrote to memory of 1932	2844	asjaszsdge.exe	95
PID 2844 wrote to memory of 1932	2844	asjaszsdge.exe	95
PID 1932 wrote to memory of 3420	1932	conhost.exe	96
PID 1932 wrote to memory of 3420	1932	conhost.exe	96
PID 3420 wrote to memory of 3532	3420	sihost64.exe	101
PID 3420 wrote to memory of 3532	3420	sihost64.exe	101
PID 3420 wrote to memory of 3532	3420	sihost64.exe	101

C:\Users\Admin\AppData\Local\Temp\f9d5c1cd96f5884fbed96d46be260037.exe
"C:\Users\Admin\AppData\Local\Temp\f9d5c1cd96f5884fbed96d46be260037.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\f9d5c1cd96f5884fbed96d46be260037.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\System32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "asjaszsdge" /tr "C:\Users\Admin\AppData\Roaming\Windows\asjaszsdge.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:884
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "asjaszsdge" /tr "C:\Users\Admin\AppData\Roaming\Windows\asjaszsdge.exe"
      4⤵
      Creates scheduled task(s)
      PID:2540
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\Windows\asjaszsdge.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Users\Admin\AppData\Roaming\Windows\asjaszsdge.exe
      C:\Users\Admin\AppData\Roaming\Windows\asjaszsdge.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2844
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\Windows\asjaszsdge.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1932
      - C:\Users\Admin\AppData\Roaming\Windows\Telemetry\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows\Telemetry\sihost64.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3420
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "zbeeflomqm"
        7⤵
        
        PID:3532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-139-0x00007FFC07753000-0x00007FFC07755000-memory.dmp

Download

memory/1932-142-0x00000232DD106000-0x00000232DD107000-memory.dmp

Download

memory/1932-140-0x00000232DD100000-0x00000232DD102000-memory.dmp

Download

memory/1932-141-0x00000232DD103000-0x00000232DD105000-memory.dmp

Download

memory/1936-135-0x000002753A796000-0x000002753A797000-memory.dmp

Download

memory/1936-134-0x000002753A793000-0x000002753A795000-memory.dmp

Download

memory/1936-133-0x000002753A7D0000-0x000002753A7E2000-memory.dmp

Download

memory/1936-132-0x000002753A790000-0x000002753A792000-memory.dmp

Download

memory/1936-131-0x00007FFC07753000-0x00007FFC07755000-memory.dmp

Download

memory/1936-130-0x0000027538940000-0x0000027538B32000-memory.dmp

Download

memory/2456-150-0x000001AA38B60000-0x000001AA38B70000-memory.dmp

Download

memory/2456-152-0x000001AA3B7C0000-0x000001AA3B7C4000-memory.dmp

Download

memory/2456-151-0x000001AA39120000-0x000001AA39130000-memory.dmp

Download

memory/3532-146-0x00007FFC07713000-0x00007FFC07715000-memory.dmp

Download

memory/3532-149-0x00000243B52D6000-0x00000243B52D7000-memory.dmp

Download

memory/3532-148-0x00000243B52D3000-0x00000243B52D5000-memory.dmp

Download

memory/3532-147-0x00000243B52D0000-0x00000243B52D2000-memory.dmp

Download

memory/3532-145-0x000002439AD80000-0x000002439AD86000-memory.dmp

Download