Analysis
-
max time kernel
153s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 05:23
Static task
static1
Behavioral task
behavioral1
Sample
8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe
Resource
win10v2004-20220414-en
General
-
Target
8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe
-
Size
164KB
-
MD5
715d74c965242d4a7d7eef5e8db5eac2
-
SHA1
a35ce7d6b5b205cb9cbdff2322f345b5b4c88749
-
SHA256
8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5
-
SHA512
991b8600e1247f507a4582fcf7915141f993057f993bfe7b8581f7ed70f94dbf6d7f5185d40894bcf4432318dd22b2d515dfb19c766676ab46f0b022c0ea77fd
Malware Config
Signatures
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 2 IoCs
Processes:
TASKKILL.exeTASKKILL.exepid process 1288 TASKKILL.exe 1392 TASKKILL.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exepid process 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exeTASKKILL.exeTASKKILL.exedescription pid process Token: SeDebugPrivilege 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe Token: SeDebugPrivilege 1288 TASKKILL.exe Token: SeDebugPrivilege 1392 TASKKILL.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exedescription pid process target process PID 1480 wrote to memory of 1012 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe schtasks.exe PID 1480 wrote to memory of 1012 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe schtasks.exe PID 1480 wrote to memory of 1012 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe schtasks.exe PID 1480 wrote to memory of 1012 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe schtasks.exe PID 1480 wrote to memory of 896 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe schtasks.exe PID 1480 wrote to memory of 896 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe schtasks.exe PID 1480 wrote to memory of 896 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe schtasks.exe PID 1480 wrote to memory of 896 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe schtasks.exe PID 1480 wrote to memory of 1288 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe TASKKILL.exe PID 1480 wrote to memory of 1288 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe TASKKILL.exe PID 1480 wrote to memory of 1288 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe TASKKILL.exe PID 1480 wrote to memory of 1288 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe TASKKILL.exe PID 1480 wrote to memory of 1392 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe TASKKILL.exe PID 1480 wrote to memory of 1392 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe TASKKILL.exe PID 1480 wrote to memory of 1392 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe TASKKILL.exe PID 1480 wrote to memory of 1392 1480 8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe TASKKILL.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe"C:\Users\Admin\AppData\Local\Temp\8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\8f421c919d5d885275754df8539ef6ee7da254c2835e405522467d8adb4379f5.exe" /sc minute /mo 52⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/896-57-0x0000000000000000-mapping.dmp
-
memory/1012-56-0x0000000000000000-mapping.dmp
-
memory/1288-58-0x0000000000000000-mapping.dmp
-
memory/1392-59-0x0000000000000000-mapping.dmp
-
memory/1480-54-0x0000000074F91000-0x0000000074F93000-memory.dmpFilesize
8KB
-
memory/1480-55-0x0000000073FB0000-0x000000007455B000-memory.dmpFilesize
5.7MB
-
memory/1480-60-0x00000000001B5000-0x00000000001C6000-memory.dmpFilesize
68KB
-
memory/1480-61-0x0000000073FB0000-0x000000007455B000-memory.dmpFilesize
5.7MB
-
memory/1480-62-0x00000000001B5000-0x00000000001C6000-memory.dmpFilesize
68KB