Analysis
-
max time kernel
132s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
26-03-2022 11:32
Static task
static1
Behavioral task
behavioral1
Sample
575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe
Resource
win10v2004-en-20220113
General
-
Target
575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe
-
Size
830KB
-
MD5
939f26c3678098a40fcea9a4302a70d9
-
SHA1
e2a8bebb901dbda91d672302d177510e813645de
-
SHA256
575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2
-
SHA512
995365a65c753ec603e47950a040fa41baefc0dd1aafe3b34bb0dfcb01687d6d66ad2aa3b1958d6fa65063ba2e7cd868cea4869351297ac8532629e8d0c5eee1
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1092 set thread context of 2172 1092 575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe 81 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2400 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2172 575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe 2172 575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe 2920 powershell.exe 2920 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1092 575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2172 575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe Token: SeDebugPrivilege 2920 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1092 wrote to memory of 1476 1092 575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe 80 PID 1092 wrote to memory of 1476 1092 575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe 80 PID 1092 wrote to memory of 1476 1092 575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe 80 PID 1092 wrote to memory of 2172 1092 575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe 81 PID 1092 wrote to memory of 2172 1092 575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe 81 PID 1092 wrote to memory of 2172 1092 575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe 81 PID 1092 wrote to memory of 2172 1092 575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe 81 PID 1476 wrote to memory of 2400 1476 cmd.exe 82 PID 1476 wrote to memory of 2400 1476 cmd.exe 82 PID 1476 wrote to memory of 2400 1476 cmd.exe 82 PID 2172 wrote to memory of 2920 2172 575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe 91 PID 2172 wrote to memory of 2920 2172 575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe 91 PID 2172 wrote to memory of 2920 2172 575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe"C:\Users\Admin\AppData\Local\Temp\575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\cmd.execmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\3d5b5cf62fb348a1997d8acab32e4735.xml"2⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\3d5b5cf62fb348a1997d8acab32e4735.xml"3⤵
- Creates scheduled task(s)
PID:2400
-
-
-
C:\Users\Admin\AppData\Local\Temp\575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe"C:\Users\Admin\AppData\Local\Temp\575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\575ceb882f19bc136874018d14e3b8222741098dfb7fc3012d1248bf7293e2e2.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c673ecc050b1038f727be09aa61cb4b1
SHA1d2960b6d62810ce8745f6353d6924ae79af01e7e
SHA2568f2648a15094c455e21cab1ba01133d9d9d17caaab1bb2ee782da160898880e4
SHA512d6b75c8068c3d9208585413f7a799f69b05e141446d09925f9aae34ac65c0745f37196ec3aeb369e2c8dea6ddfcc55c07fe8f227a06d79dfa408f3d2315c29e6