f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
04-08-2022 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Service.exe
Size

400KB
MD5

9519c85c644869f182927d93e8e25a33
SHA1

eadc9026e041f7013056f80e068ecf95940ea060
SHA256

f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b
SHA512

dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 ipinfo.io
12 ipinfo.io

flow	ioc
11	ipinfo.io
12	ipinfo.io

Drops file in Program Files directory 2 IoCs

Processes:

Service.exe

description	ioc	process
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	Service.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	Service.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1568 schtasks.exe
1688 schtasks.exe

pid	process
1568	schtasks.exe
1688	schtasks.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Service.exe

description	pid	process	target process
PID 1972 wrote to memory of 1568	1972	Service.exe	schtasks.exe
PID 1972 wrote to memory of 1568	1972	Service.exe	schtasks.exe
PID 1972 wrote to memory of 1568	1972	Service.exe	schtasks.exe
PID 1972 wrote to memory of 1568	1972	Service.exe	schtasks.exe
PID 1972 wrote to memory of 1688	1972	Service.exe	schtasks.exe
PID 1972 wrote to memory of 1688	1972	Service.exe	schtasks.exe
PID 1972 wrote to memory of 1688	1972	Service.exe	schtasks.exe
PID 1972 wrote to memory of 1688	1972	Service.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Service.exe
"C:\Users\Admin\AppData\Local\Temp\Service.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:1568

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:1688

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-55-0x0000000000000000-mapping.dmp

Download
memory/1688-56-0x0000000000000000-mapping.dmp

Download
memory/1972-54-0x0000000074F71000-0x0000000074F73000-memory.dmp

Filesize
8KB

Download