Analysis
-
max time kernel
132s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
26-03-2022 09:39
Static task
static1
Behavioral task
behavioral1
Sample
ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe
Resource
win10v2004-en-20220113
General
-
Target
ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe
-
Size
1.2MB
-
MD5
57aed4d62cc8ed78cfb6b18c29d1ae05
-
SHA1
2ad0e3ee508ed48d9af6c5c980651ffea3274993
-
SHA256
ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b
-
SHA512
f24bd2d7dc0bed2d4f1d19fa4e6eb4c3f0f1994d5fd45a68dba1afdbf46d0dbf58883856f8b7cf68f8c3779138f72cdd52cf963ded5d13b6da7e9bea05169052
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1096 set thread context of 1828 1096 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe 81 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2356 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1828 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe 1828 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe 4232 powershell.exe 4232 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1096 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1828 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe Token: SeDebugPrivilege 4232 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1096 wrote to memory of 1724 1096 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe 79 PID 1096 wrote to memory of 1724 1096 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe 79 PID 1096 wrote to memory of 1724 1096 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe 79 PID 1096 wrote to memory of 1828 1096 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe 81 PID 1096 wrote to memory of 1828 1096 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe 81 PID 1096 wrote to memory of 1828 1096 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe 81 PID 1096 wrote to memory of 1828 1096 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe 81 PID 1724 wrote to memory of 2356 1724 cmd.exe 82 PID 1724 wrote to memory of 2356 1724 cmd.exe 82 PID 1724 wrote to memory of 2356 1724 cmd.exe 82 PID 1828 wrote to memory of 4232 1828 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe 84 PID 1828 wrote to memory of 4232 1828 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe 84 PID 1828 wrote to memory of 4232 1828 ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe"C:\Users\Admin\AppData\Local\Temp\ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\cmd.execmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\3bc9d0e4991c4127854c846f1c363314.xml"2⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\3bc9d0e4991c4127854c846f1c363314.xml"3⤵
- Creates scheduled task(s)
PID:2356
-
-
-
C:\Users\Admin\AppData\Local\Temp\ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe"C:\Users\Admin\AppData\Local\Temp\ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\ca6dbe9ccf2dbcf8cfa6cb04dada5d7caaa594fbfa83e424dda4f88911b4af6b.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c673ecc050b1038f727be09aa61cb4b1
SHA1d2960b6d62810ce8745f6353d6924ae79af01e7e
SHA2568f2648a15094c455e21cab1ba01133d9d9d17caaab1bb2ee782da160898880e4
SHA512d6b75c8068c3d9208585413f7a799f69b05e141446d09925f9aae34ac65c0745f37196ec3aeb369e2c8dea6ddfcc55c07fe8f227a06d79dfa408f3d2315c29e6