Overview
overview
10Static
static
10202ad65f39...2f.exe
windows7-x64
10202ad65f39...2f.exe
windows10-2004-x64
102722079047...42.exe
windows7-x64
82722079047...42.exe
windows10-2004-x64
861b08c9b1c...29.exe
windows7-x64
1061b08c9b1c...29.exe
windows10-2004-x64
10a89d4dfabf...a9.exe
windows7-x64
10a89d4dfabf...a9.exe
windows10-2004-x64
10bb1e9db6d9...76.exe
windows7-x64
10bb1e9db6d9...76.exe
windows10-2004-x64
10e9fca3db7f...67.exe
windows7-x64
10e9fca3db7f...67.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-09-2022 13:02
Behavioral task
behavioral1
Sample
202ad65f3956cde4764d1a789c3bac46a8b9dca3203c783a1efdc058bd94022f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
202ad65f3956cde4764d1a789c3bac46a8b9dca3203c783a1efdc058bd94022f.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
61b08c9b1c1f836a8fe354ae53110ffc66ef1ecb9ea353b345d7690a0bb3be29.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
61b08c9b1c1f836a8fe354ae53110ffc66ef1ecb9ea353b345d7690a0bb3be29.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
a89d4dfabf30a221b56db35ebe5b5852ad16fc8e8828d169219e97c849ec5fa9.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
a89d4dfabf30a221b56db35ebe5b5852ad16fc8e8828d169219e97c849ec5fa9.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
bb1e9db6d9b4b5a858987999a1c8b68ea3610382968c36771da27a6625eba776.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
bb1e9db6d9b4b5a858987999a1c8b68ea3610382968c36771da27a6625eba776.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral11
Sample
e9fca3db7f9c56f58cc1e28118c9897aa3cd0d2e052c62b3aed472bede51e467.exe
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
e9fca3db7f9c56f58cc1e28118c9897aa3cd0d2e052c62b3aed472bede51e467.exe
Resource
win10v2004-20220812-en
General
-
Target
27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe
-
Size
1.7MB
-
MD5
9ec8bc3dbfdcfe1540bd3274181ae9bb
-
SHA1
a5e610f5e4d56e7ac8c7b6b20a2726cf362ba316
-
SHA256
27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942
-
SHA512
d030b4b8beb58fd683ebb5f883566dbe8fab5a8bacad52f45e428eb71efdd90c6d35629769ac461a35f94471cd57d943d6e6bd8898596919b34eacaca701d117
-
SSDEEP
49152:1Tvt1GjeX+xaFTx+IJPPpU4XOulXn8djKj:1T7zOaaqPpv8d2
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
OneDrive.exeOneDrive.exeOneDrive.exepid process 1012 OneDrive.exe 868 OneDrive.exe 1088 OneDrive.exe -
Processes:
resource yara_rule behavioral3/memory/1112-55-0x00000000003B0000-0x00000000009FF000-memory.dmp upx behavioral3/memory/1112-79-0x00000000003B0000-0x00000000009FF000-memory.dmp upx \Users\Admin\AppData\Local\OneDrive\OneDrive.exe upx \Users\Admin\AppData\Local\OneDrive\OneDrive.exe upx C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe upx C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe upx behavioral3/memory/1012-85-0x0000000000C70000-0x00000000012BF000-memory.dmp upx behavioral3/memory/1112-86-0x00000000003B0000-0x00000000009FF000-memory.dmp upx \Users\Admin\AppData\Local\OneDrive\OneDrive.exe upx C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe upx behavioral3/memory/868-91-0x0000000000C70000-0x00000000012BF000-memory.dmp upx behavioral3/memory/868-115-0x0000000000C70000-0x00000000012BF000-memory.dmp upx behavioral3/memory/868-116-0x0000000000C70000-0x00000000012BF000-memory.dmp upx \Users\Admin\AppData\Local\OneDrive\OneDrive.exe upx C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe upx behavioral3/memory/1088-120-0x0000000000F00000-0x000000000154F000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
taskeng.exepid process 108 taskeng.exe 108 taskeng.exe 108 taskeng.exe 108 taskeng.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exeOneDrive.exedescription pid process target process PID 1112 set thread context of 908 1112 27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe svchost.exe PID 868 set thread context of 840 868 OneDrive.exe svchost.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exetaskeng.exeOneDrive.exedescription pid process target process PID 1112 wrote to memory of 1176 1112 27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe schtasks.exe PID 1112 wrote to memory of 1176 1112 27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe schtasks.exe PID 1112 wrote to memory of 1176 1112 27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe schtasks.exe PID 1112 wrote to memory of 908 1112 27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe svchost.exe PID 1112 wrote to memory of 908 1112 27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe svchost.exe PID 1112 wrote to memory of 908 1112 27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe svchost.exe PID 1112 wrote to memory of 908 1112 27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe svchost.exe PID 1112 wrote to memory of 908 1112 27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe svchost.exe PID 1112 wrote to memory of 908 1112 27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe svchost.exe PID 1112 wrote to memory of 908 1112 27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe svchost.exe PID 1112 wrote to memory of 908 1112 27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe svchost.exe PID 1112 wrote to memory of 908 1112 27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe svchost.exe PID 1112 wrote to memory of 908 1112 27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe svchost.exe PID 1112 wrote to memory of 908 1112 27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe svchost.exe PID 108 wrote to memory of 1012 108 taskeng.exe OneDrive.exe PID 108 wrote to memory of 1012 108 taskeng.exe OneDrive.exe PID 108 wrote to memory of 1012 108 taskeng.exe OneDrive.exe PID 108 wrote to memory of 868 108 taskeng.exe OneDrive.exe PID 108 wrote to memory of 868 108 taskeng.exe OneDrive.exe PID 108 wrote to memory of 868 108 taskeng.exe OneDrive.exe PID 868 wrote to memory of 840 868 OneDrive.exe svchost.exe PID 868 wrote to memory of 840 868 OneDrive.exe svchost.exe PID 868 wrote to memory of 840 868 OneDrive.exe svchost.exe PID 868 wrote to memory of 840 868 OneDrive.exe svchost.exe PID 868 wrote to memory of 840 868 OneDrive.exe svchost.exe PID 868 wrote to memory of 840 868 OneDrive.exe svchost.exe PID 868 wrote to memory of 840 868 OneDrive.exe svchost.exe PID 868 wrote to memory of 840 868 OneDrive.exe svchost.exe PID 868 wrote to memory of 840 868 OneDrive.exe svchost.exe PID 868 wrote to memory of 840 868 OneDrive.exe svchost.exe PID 868 wrote to memory of 840 868 OneDrive.exe svchost.exe PID 108 wrote to memory of 1088 108 taskeng.exe OneDrive.exe PID 108 wrote to memory of 1088 108 taskeng.exe OneDrive.exe PID 108 wrote to memory of 1088 108 taskeng.exe OneDrive.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe"C:\Users\Admin\AppData\Local\Temp\27220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 1 /tn OneDrive /rl HIGHEST /tr C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe2⤵
- Creates scheduled task(s)
PID:1176 -
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe YmMxcTVjZHZ1N3RlN2xmaDBkOWR4ZndoYTdmNXBzaHl2ZnB0NXVhaGVkLDQ0RHM4ZmJDM0hXUUNjd1FvdGdyTkRVV25tRGl4cFFQRzdZTGg1aDJyelNNUXJ4Q1JYZVNqUXZIOExSUE5HU3lxdlhjS2VFazN1bVo3VDJ3ekZBZ292RjE1VWNrQnhnLDB4MDNlQmFCNjg0ZDNmYjI0QmVERmMzMWREYTRGNTVjQzAyMkU1NzEwMSxYbURTUU1tVjV2eGo4Y3U4eFNraFVjZldmRndtc0FZdDNpLHIzeUExd2VvUlc1THdNY0xoelBvdG1xU3huMjRFNzZXdWgsRFNSRDd6WEtOVXJZZmtpUERTdTFYRFdyZ2dkRTlTTGNRVyxMVVE5SmVHMkpOOUQ1VHRLdnlQRFZ6cWpTUjV4V0h4a3VRLFRQc0xGMmVUVHExMTJVS2Vvb0xWNHFBZzN0b3lDNWg2VE0sR0FZSjZOVkxKM1ZZRVRGVU5JNkxBRDVFREVQRTVEUFhaV1dRUEZWNFlIRkdIU0YzNkc0TENSUE4sQVZENjlIZHF1WEJ1RWpma0FEV0JDcXM1bmVWQ2VXQjMxZyxxcHQ5bXNqaDN0N3VjOTJwbmx3a3NtOWRkbjJrcWhtNmc1ZjQzbWUyZHAsYWRkcjFxeWYyc244dWF6N2o0NDB2ZXM5NmFkZHB1ZWFtOGY5cjlndTh2NDVsc2p4bGw3cWo0cHgwZTY5YTl0MjdlbnF0NDY2NnJlbm1rd2oyeDIzY3dldGZscHlkbGx1cWtwOWszbix0MVNrUzJrS0dvSnRqcHFhUGVWQlltc2JHcXMyR1ZkMWRzbSxHUEpkSk5GS0RORjFKcnZORG5tUXRqNHA1cVJpNWRmWmo1LDEyaEc4S2V3VmtoS1JIZUhmWVFlZEpMSHViWWliTGNBa1h1bjc1ckY0Yld5OVJrUA==2⤵PID:908
-
C:\Windows\system32\taskeng.exetaskeng.exe {C3D27779-9F9E-400A-8C25-E38F8BB55C9F} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exeC:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe2⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exeC:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe YmMxcTVjZHZ1N3RlN2xmaDBkOWR4ZndoYTdmNXBzaHl2ZnB0NXVhaGVkLDQ0RHM4ZmJDM0hXUUNjd1FvdGdyTkRVV25tRGl4cFFQRzdZTGg1aDJyelNNUXJ4Q1JYZVNqUXZIOExSUE5HU3lxdlhjS2VFazN1bVo3VDJ3ekZBZ292RjE1VWNrQnhnLDB4MDNlQmFCNjg0ZDNmYjI0QmVERmMzMWREYTRGNTVjQzAyMkU1NzEwMSxYbURTUU1tVjV2eGo4Y3U4eFNraFVjZldmRndtc0FZdDNpLHIzeUExd2VvUlc1THdNY0xoelBvdG1xU3huMjRFNzZXdWgsRFNSRDd6WEtOVXJZZmtpUERTdTFYRFdyZ2dkRTlTTGNRVyxMVVE5SmVHMkpOOUQ1VHRLdnlQRFZ6cWpTUjV4V0h4a3VRLFRQc0xGMmVUVHExMTJVS2Vvb0xWNHFBZzN0b3lDNWg2VE0sR0FZSjZOVkxKM1ZZRVRGVU5JNkxBRDVFREVQRTVEUFhaV1dRUEZWNFlIRkdIU0YzNkc0TENSUE4sQVZENjlIZHF1WEJ1RWpma0FEV0JDcXM1bmVWQ2VXQjMxZyxxcHQ5bXNqaDN0N3VjOTJwbmx3a3NtOWRkbjJrcWhtNmc1ZjQzbWUyZHAsYWRkcjFxeWYyc244dWF6N2o0NDB2ZXM5NmFkZHB1ZWFtOGY5cjlndTh2NDVsc2p4bGw3cWo0cHgwZTY5YTl0MjdlbnF0NDY2NnJlbm1rd2oyeDIzY3dldGZscHlkbGx1cWtwOWszbix0MVNrUzJrS0dvSnRqcHFhUGVWQlltc2JHcXMyR1ZkMWRzbSxHUEpkSk5GS0RORjFKcnZORG5tUXRqNHA1cVJpNWRmWmo1LDEyaEc4S2V3VmtoS1JIZUhmWVFlZEpMSHViWWliTGNBa1h1bjc1ckY0Yld5OVJrUA==3⤵PID:840
-
C:\Users\Admin\AppData\Local\OneDrive\OneDrive.exeC:\Users\Admin\AppData\Local\OneDrive\OneDrive.exe2⤵
- Executes dropped EXE
PID:1088
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD59ec8bc3dbfdcfe1540bd3274181ae9bb
SHA1a5e610f5e4d56e7ac8c7b6b20a2726cf362ba316
SHA25627220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942
SHA512d030b4b8beb58fd683ebb5f883566dbe8fab5a8bacad52f45e428eb71efdd90c6d35629769ac461a35f94471cd57d943d6e6bd8898596919b34eacaca701d117
-
Filesize
1.7MB
MD59ec8bc3dbfdcfe1540bd3274181ae9bb
SHA1a5e610f5e4d56e7ac8c7b6b20a2726cf362ba316
SHA25627220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942
SHA512d030b4b8beb58fd683ebb5f883566dbe8fab5a8bacad52f45e428eb71efdd90c6d35629769ac461a35f94471cd57d943d6e6bd8898596919b34eacaca701d117
-
Filesize
1.7MB
MD59ec8bc3dbfdcfe1540bd3274181ae9bb
SHA1a5e610f5e4d56e7ac8c7b6b20a2726cf362ba316
SHA25627220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942
SHA512d030b4b8beb58fd683ebb5f883566dbe8fab5a8bacad52f45e428eb71efdd90c6d35629769ac461a35f94471cd57d943d6e6bd8898596919b34eacaca701d117
-
Filesize
1.7MB
MD59ec8bc3dbfdcfe1540bd3274181ae9bb
SHA1a5e610f5e4d56e7ac8c7b6b20a2726cf362ba316
SHA25627220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942
SHA512d030b4b8beb58fd683ebb5f883566dbe8fab5a8bacad52f45e428eb71efdd90c6d35629769ac461a35f94471cd57d943d6e6bd8898596919b34eacaca701d117
-
Filesize
1.7MB
MD59ec8bc3dbfdcfe1540bd3274181ae9bb
SHA1a5e610f5e4d56e7ac8c7b6b20a2726cf362ba316
SHA25627220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942
SHA512d030b4b8beb58fd683ebb5f883566dbe8fab5a8bacad52f45e428eb71efdd90c6d35629769ac461a35f94471cd57d943d6e6bd8898596919b34eacaca701d117
-
Filesize
1.7MB
MD59ec8bc3dbfdcfe1540bd3274181ae9bb
SHA1a5e610f5e4d56e7ac8c7b6b20a2726cf362ba316
SHA25627220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942
SHA512d030b4b8beb58fd683ebb5f883566dbe8fab5a8bacad52f45e428eb71efdd90c6d35629769ac461a35f94471cd57d943d6e6bd8898596919b34eacaca701d117
-
Filesize
1.7MB
MD59ec8bc3dbfdcfe1540bd3274181ae9bb
SHA1a5e610f5e4d56e7ac8c7b6b20a2726cf362ba316
SHA25627220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942
SHA512d030b4b8beb58fd683ebb5f883566dbe8fab5a8bacad52f45e428eb71efdd90c6d35629769ac461a35f94471cd57d943d6e6bd8898596919b34eacaca701d117
-
Filesize
1.7MB
MD59ec8bc3dbfdcfe1540bd3274181ae9bb
SHA1a5e610f5e4d56e7ac8c7b6b20a2726cf362ba316
SHA25627220790475f6cf42fbaff5e5fbdfe452b7d79116547878b01ecdbc1c6a5b942
SHA512d030b4b8beb58fd683ebb5f883566dbe8fab5a8bacad52f45e428eb71efdd90c6d35629769ac461a35f94471cd57d943d6e6bd8898596919b34eacaca701d117