Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    26-03-2022 15:02

General

  • Target

    3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe

  • Size

    821KB

  • MD5

    b0c6c62c19099f962f6a8c942051c33d

  • SHA1

    0985c98469e35361d235df11417b0bf9ead7f110

  • SHA256

    3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e

  • SHA512

    bc9710bf121a9c4887a317931e60b57f73497bd836e918e1765812bedbc312af611e8c298860b44bce2ecc3a3776725b0be4cb4091382d74d41e94930897e735

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe
    "C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\9d77f4a40ffa452f8c1e2fdd2b545943.xml"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3652
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\9d77f4a40ffa452f8c1e2fdd2b545943.xml"
        3⤵
        • Creates scheduled task(s)
        PID:3680
    • C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe
      "C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3424
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3952

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\9d77f4a40ffa452f8c1e2fdd2b545943.xml

    Filesize

    1KB

    MD5

    c673ecc050b1038f727be09aa61cb4b1

    SHA1

    d2960b6d62810ce8745f6353d6924ae79af01e7e

    SHA256

    8f2648a15094c455e21cab1ba01133d9d9d17caaab1bb2ee782da160898880e4

    SHA512

    d6b75c8068c3d9208585413f7a799f69b05e141446d09925f9aae34ac65c0745f37196ec3aeb369e2c8dea6ddfcc55c07fe8f227a06d79dfa408f3d2315c29e6

  • memory/3424-134-0x0000000005540000-0x00000000055D2000-memory.dmp

    Filesize

    584KB

  • memory/3424-135-0x0000000005DF0000-0x0000000006394000-memory.dmp

    Filesize

    5.6MB

  • memory/3424-136-0x00000000058B0000-0x0000000005916000-memory.dmp

    Filesize

    408KB

  • memory/3952-138-0x0000000002C70000-0x0000000002CA6000-memory.dmp

    Filesize

    216KB

  • memory/3952-139-0x00000000058F0000-0x0000000005F18000-memory.dmp

    Filesize

    6.2MB

  • memory/3952-140-0x00000000055A0000-0x00000000055C2000-memory.dmp

    Filesize

    136KB

  • memory/3952-141-0x0000000005840000-0x00000000058A6000-memory.dmp

    Filesize

    408KB

  • memory/3952-142-0x00000000065F0000-0x000000000660E000-memory.dmp

    Filesize

    120KB

  • memory/3952-143-0x00000000052B5000-0x00000000052B7000-memory.dmp

    Filesize

    8KB

  • memory/3952-144-0x0000000007C40000-0x00000000082BA000-memory.dmp

    Filesize

    6.5MB

  • memory/3952-145-0x0000000006AE0000-0x0000000006AFA000-memory.dmp

    Filesize

    104KB

  • memory/3952-146-0x0000000007860000-0x00000000078F6000-memory.dmp

    Filesize

    600KB

  • memory/3952-147-0x0000000006BC0000-0x0000000006BE2000-memory.dmp

    Filesize

    136KB