0aec2ca096ad5b30e9d542cdc96171de86ca12f0b9bc9066cc05de583adf5ad1

Analysis

max time kernel
175s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
16/05/2022, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
41937DB442356AFA8933D024EF8CC377.exe
Size 2.1MB
Sample220516-vkp4pseagn
SHA256 0aec2ca096ad5b30e9d542cdc96171de86ca12f0b9bc9066cc05de583adf5ad1
MD5 41937db442356afa8933d024ef8cc377
SHA1 b5917e27512afad14b67e2f456c51a95d655595f
SHA512 60178c86accf80f7521577fe6745a1c1fabccc858da68586af6636e57c1f3c6a23ca0950cd108d58974f71e29248d7b5a66d9ccb5bf269fa1ac444b7688edbdd
MD5 SHA1 SHA512

Score

10^/10

suricata

Malware Config

Signatures

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3872	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1316	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	728	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4172	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3332	4660	schtasks.exe	20
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3740	4660	schtasks.exe	20

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

Executes dropped EXE 1 IoCs

pid	Process
2136	lsass.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	41937DB442356AFA8933D024EF8CC377.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	lsass.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\SIHClient.exe	41937DB442356AFA8933D024EF8CC377.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\SIHClient.exe	41937DB442356AFA8933D024EF8CC377.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\7b3bf1de107bcf	41937DB442356AFA8933D024EF8CC377.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\lsass.exe	41937DB442356AFA8933D024EF8CC377.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\6203df4a6bafc7	41937DB442356AFA8933D024EF8CC377.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\L2Schemas\27d1bcfc3c54e0	41937DB442356AFA8933D024EF8CC377.exe
File created	C:\Windows\security\ApplicationId\SearchApp.exe	41937DB442356AFA8933D024EF8CC377.exe
File created	C:\Windows\security\ApplicationId\38384e6a620884	41937DB442356AFA8933D024EF8CC377.exe
File created	C:\Windows\L2Schemas\System.exe	41937DB442356AFA8933D024EF8CC377.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4060	schtasks.exe
3872	schtasks.exe
2304	schtasks.exe
4676	schtasks.exe
4844	schtasks.exe
4172	schtasks.exe
224	schtasks.exe
4756	schtasks.exe
1204	schtasks.exe
220	schtasks.exe
1316	schtasks.exe
4688	schtasks.exe
4872	schtasks.exe
4632	schtasks.exe
3364	schtasks.exe
1112	schtasks.exe
3160	schtasks.exe
4416	schtasks.exe
4748	schtasks.exe
2028	schtasks.exe
1436	schtasks.exe
4256	schtasks.exe
4840	schtasks.exe
3648	schtasks.exe
408	schtasks.exe
1172	schtasks.exe
3332	schtasks.exe
332	schtasks.exe
728	schtasks.exe
3740	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	lsass.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3464	41937DB442356AFA8933D024EF8CC377.exe
2136	lsass.exe
2136	lsass.exe
2136	lsass.exe
2136	lsass.exe
2136	lsass.exe
2136	lsass.exe
2136	lsass.exe
2136	lsass.exe
2136	lsass.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	41937DB442356AFA8933D024EF8CC377.exe
Token: SeDebugPrivilege	2136	lsass.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 2136	3464	41937DB442356AFA8933D024EF8CC377.exe	112
PID 3464 wrote to memory of 2136	3464	41937DB442356AFA8933D024EF8CC377.exe	112
PID 2136 wrote to memory of 2232	2136	lsass.exe	113
PID 2136 wrote to memory of 2232	2136	lsass.exe	113
PID 2136 wrote to memory of 2960	2136	lsass.exe	114
PID 2136 wrote to memory of 2960	2136	lsass.exe	114

C:\Users\Admin\AppData\Local\Temp\41937DB442356AFA8933D024EF8CC377.exe
"C:\Users\Admin\AppData\Local\Temp\41937DB442356AFA8933D024EF8CC377.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464
- C:\odt\lsass.exe
  "C:\odt\lsass.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ed0b31e-9b40-4278-a572-4a550d7475ed.vbs"
    3⤵
    PID:2232
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05d3b33b-2bc8-4244-a52c-b297f9d5bf0e.vbs"
    3⤵
    PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\SIHClient.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClient" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\SIHClient.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SIHClientS" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\SIHClient.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\L2Schemas\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\L2Schemas\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\L2Schemas\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\odt\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\USOShared\Logs\User\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\USOShared\Logs\User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\USOShared\Logs\User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Windows\security\ApplicationId\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\security\ApplicationId\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Windows\security\ApplicationId\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

05d3b33b-2bc8-4244-a52c-b297f9d5bf0e.vbs

Path C:\Users\Admin\AppData\Local\Temp\05d3b33b-2bc8-4244-a52c-b297f9d5bf0e.vbs
Size 468B
SHA256 6529364a40fe6a948438ce9cc22678750ffb2513dfc37095c714828680b65e0f
MD5 48c1be83ba56440294074a04adabcf15
SHA1 1cea9294b9d2ea739d02e83331e094e3a3913a6e
SHA512 76a14ee3259ec3a4bb77e53ce028100ca080a6e46878624a8edaa1f6b3b0f670a71eac1cd4f13df08fd0ab5d2572759e6af18c5daab5604f8cd4a0e9e2457d4a
MD5 SHA1 SHA512

Submit Download

2ed0b31e-9b40-4278-a572-4a550d7475ed.vbs

Path C:\Users\Admin\AppData\Local\Temp\2ed0b31e-9b40-4278-a572-4a550d7475ed.vbs
Size 692B
SHA256 baedd6191c8a4bd8965170e594ec9eff2851d5c2b6874e5a9020bea2f9fd7ed8
MD5 9a9a0770314146d320761f25c3ec4e88
SHA1 f341cb132e65bba8b84af5e75dc1f080b89df3b8
SHA512 e2d6acc4852e72eaa379f1b9c8b376a8502d401c2e968e835352492a9f30116538c21e461bee252f3bfbed47cd8a160fa34f68f516fb84799a9f640fea022515
MD5 SHA1 SHA512

Submit Download

lsass.exe

Path C:\odt\lsass.exe
Size 2.1MB
SHA256 0aec2ca096ad5b30e9d542cdc96171de86ca12f0b9bc9066cc05de583adf5ad1
MD5 41937db442356afa8933d024ef8cc377
SHA1 b5917e27512afad14b67e2f456c51a95d655595f
SHA512 60178c86accf80f7521577fe6745a1c1fabccc858da68586af6636e57c1f3c6a23ca0950cd108d58974f71e29248d7b5a66d9ccb5bf269fa1ac444b7688edbdd
SSDEEP 49152:jQQcKKPKxmvwBoKRcTtwHZtpQ3QJWOBJlizZXmT:UQcKKyovlKRcTtE8fOBJlizZX
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\odt\lsass.exe
Size 2.1MB
SHA256 0aec2ca096ad5b30e9d542cdc96171de86ca12f0b9bc9066cc05de583adf5ad1
MD5 41937db442356afa8933d024ef8cc377
SHA1 b5917e27512afad14b67e2f456c51a95d655595f
SHA512 60178c86accf80f7521577fe6745a1c1fabccc858da68586af6636e57c1f3c6a23ca0950cd108d58974f71e29248d7b5a66d9ccb5bf269fa1ac444b7688edbdd
SSDEEP 49152:jQQcKKPKxmvwBoKRcTtwHZtpQ3QJWOBJlizZXmT:UQcKKyovlKRcTtE8fOBJlizZX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2136-136-0x00007FF8B73B0000-0x00007FF8B7E71000-memory.dmp

Download

memory/3464-130-0x0000000000C40000-0x0000000000E6E000-memory.dmp

Download

memory/3464-131-0x00007FF8B73B0000-0x00007FF8B7E71000-memory.dmp

Download

memory/3464-132-0x000000001D170000-0x000000001D1C0000-memory.dmp

Download