Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
26-03-2022 15:02
Static task
static1
Behavioral task
behavioral1
Sample
3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe
Resource
win10v2004-en-20220113
General
-
Target
3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe
-
Size
821KB
-
MD5
b0c6c62c19099f962f6a8c942051c33d
-
SHA1
0985c98469e35361d235df11417b0bf9ead7f110
-
SHA256
3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e
-
SHA512
bc9710bf121a9c4887a317931e60b57f73497bd836e918e1765812bedbc312af611e8c298860b44bce2ecc3a3776725b0be4cb4091382d74d41e94930897e735
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2680 set thread context of 3424 2680 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 80 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3680 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3424 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 3424 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 3952 powershell.exe 3952 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2680 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3424 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe Token: SeDebugPrivilege 3952 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2680 wrote to memory of 3652 2680 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 79 PID 2680 wrote to memory of 3652 2680 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 79 PID 2680 wrote to memory of 3652 2680 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 79 PID 2680 wrote to memory of 3424 2680 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 80 PID 2680 wrote to memory of 3424 2680 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 80 PID 2680 wrote to memory of 3424 2680 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 80 PID 2680 wrote to memory of 3424 2680 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 80 PID 3652 wrote to memory of 3680 3652 cmd.exe 81 PID 3652 wrote to memory of 3680 3652 cmd.exe 81 PID 3652 wrote to memory of 3680 3652 cmd.exe 81 PID 3424 wrote to memory of 3952 3424 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 89 PID 3424 wrote to memory of 3952 3424 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 89 PID 3424 wrote to memory of 3952 3424 3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe"C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.execmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\9d77f4a40ffa452f8c1e2fdd2b545943.xml"2⤵
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\9d77f4a40ffa452f8c1e2fdd2b545943.xml"3⤵
- Creates scheduled task(s)
PID:3680
-
-
-
C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe"C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\3de18c7fe5a555a5839761c35486a1032bf654a1d56106dc92912a540f6df46e.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c673ecc050b1038f727be09aa61cb4b1
SHA1d2960b6d62810ce8745f6353d6924ae79af01e7e
SHA2568f2648a15094c455e21cab1ba01133d9d9d17caaab1bb2ee782da160898880e4
SHA512d6b75c8068c3d9208585413f7a799f69b05e141446d09925f9aae34ac65c0745f37196ec3aeb369e2c8dea6ddfcc55c07fe8f227a06d79dfa408f3d2315c29e6