Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
08-09-2022 03:56
Static task
static1
Behavioral task
behavioral1
Sample
6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca.exe
Resource
win10-20220901-en
General
-
Target
6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca.exe
-
Size
712KB
-
MD5
ea9fa66ca76fd68b6ba877fef8a017c1
-
SHA1
13d2f1af4ca15051b44b6bca4438ca3350d124b2
-
SHA256
6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca
-
SHA512
5df3d21d09a68429aa628e0d4f75d6e5f42ef0ecaaca242428a0353349b88869ad1494f14902351400ef0b6bd68cbe3c87b7de81adc64f75211c4cbaef52f9e5
-
SSDEEP
768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 4168 dllhost.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Program crash 1 IoCs
pid pid_target Process procid_target 756 2828 WerFault.exe 97 -
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2820 schtasks.exe 2828 schtasks.exe 4456 schtasks.exe 2076 schtasks.exe 4352 schtasks.exe 4944 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4944 powershell.exe 4944 powershell.exe 4944 powershell.exe 3724 powershell.exe 3724 powershell.exe 3724 powershell.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe 4168 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4944 powershell.exe Token: SeDebugPrivilege 4528 6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca.exe Token: SeDebugPrivilege 3724 powershell.exe Token: SeDebugPrivilege 4168 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4528 wrote to memory of 2008 4528 6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca.exe 66 PID 4528 wrote to memory of 2008 4528 6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca.exe 66 PID 4528 wrote to memory of 2008 4528 6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca.exe 66 PID 2008 wrote to memory of 3404 2008 cmd.exe 68 PID 2008 wrote to memory of 3404 2008 cmd.exe 68 PID 2008 wrote to memory of 3404 2008 cmd.exe 68 PID 2008 wrote to memory of 4944 2008 cmd.exe 69 PID 2008 wrote to memory of 4944 2008 cmd.exe 69 PID 2008 wrote to memory of 4944 2008 cmd.exe 69 PID 2008 wrote to memory of 3724 2008 cmd.exe 70 PID 2008 wrote to memory of 3724 2008 cmd.exe 70 PID 2008 wrote to memory of 3724 2008 cmd.exe 70 PID 4528 wrote to memory of 4168 4528 6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca.exe 71 PID 4528 wrote to memory of 4168 4528 6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca.exe 71 PID 4528 wrote to memory of 4168 4528 6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca.exe 71 PID 4168 wrote to memory of 4428 4168 dllhost.exe 72 PID 4168 wrote to memory of 4428 4168 dllhost.exe 72 PID 4168 wrote to memory of 4428 4168 dllhost.exe 72 PID 4168 wrote to memory of 4644 4168 dllhost.exe 73 PID 4168 wrote to memory of 4644 4168 dllhost.exe 73 PID 4168 wrote to memory of 4644 4168 dllhost.exe 73 PID 4168 wrote to memory of 4392 4168 dllhost.exe 74 PID 4168 wrote to memory of 4392 4168 dllhost.exe 74 PID 4168 wrote to memory of 4392 4168 dllhost.exe 74 PID 4168 wrote to memory of 4556 4168 dllhost.exe 75 PID 4168 wrote to memory of 4556 4168 dllhost.exe 75 PID 4168 wrote to memory of 4556 4168 dllhost.exe 75 PID 4168 wrote to memory of 4584 4168 dllhost.exe 76 PID 4168 wrote to memory of 4584 4168 dllhost.exe 76 PID 4168 wrote to memory of 4584 4168 dllhost.exe 76 PID 4168 wrote to memory of 4000 4168 dllhost.exe 77 PID 4168 wrote to memory of 4000 4168 dllhost.exe 77 PID 4168 wrote to memory of 4000 4168 dllhost.exe 77 PID 4168 wrote to memory of 508 4168 dllhost.exe 82 PID 4168 wrote to memory of 508 4168 dllhost.exe 82 PID 4168 wrote to memory of 508 4168 dllhost.exe 82 PID 4168 wrote to memory of 3780 4168 dllhost.exe 81 PID 4168 wrote to memory of 3780 4168 dllhost.exe 81 PID 4168 wrote to memory of 3780 4168 dllhost.exe 81 PID 4168 wrote to memory of 4776 4168 dllhost.exe 80 PID 4168 wrote to memory of 4776 4168 dllhost.exe 80 PID 4168 wrote to memory of 4776 4168 dllhost.exe 80 PID 4168 wrote to memory of 1032 4168 dllhost.exe 83 PID 4168 wrote to memory of 1032 4168 dllhost.exe 83 PID 4168 wrote to memory of 1032 4168 dllhost.exe 83 PID 4168 wrote to memory of 1852 4168 dllhost.exe 93 PID 4168 wrote to memory of 1852 4168 dllhost.exe 93 PID 4168 wrote to memory of 1852 4168 dllhost.exe 93 PID 4168 wrote to memory of 2196 4168 dllhost.exe 91 PID 4168 wrote to memory of 2196 4168 dllhost.exe 91 PID 4168 wrote to memory of 2196 4168 dllhost.exe 91 PID 4556 wrote to memory of 2820 4556 cmd.exe 96 PID 4556 wrote to memory of 2820 4556 cmd.exe 96 PID 4556 wrote to memory of 2820 4556 cmd.exe 96 PID 3780 wrote to memory of 2828 3780 cmd.exe 97 PID 3780 wrote to memory of 2828 3780 cmd.exe 97 PID 3780 wrote to memory of 2828 3780 cmd.exe 97 PID 1032 wrote to memory of 4456 1032 cmd.exe 98 PID 1032 wrote to memory of 4456 1032 cmd.exe 98 PID 1032 wrote to memory of 4456 1032 cmd.exe 98 PID 4000 wrote to memory of 2076 4000 cmd.exe 99 PID 4000 wrote to memory of 2076 4000 cmd.exe 99 PID 4000 wrote to memory of 2076 4000 cmd.exe 99 PID 4776 wrote to memory of 4352 4776 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca.exe"C:\Users\Admin\AppData\Local\Temp\6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"2⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\chcp.comchcp 12513⤵PID:3404
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4944
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3724
-
-
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4428
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4644
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4392
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:2820
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4584
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:2076
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9306" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9306" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4352
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:2828 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 4085⤵
- Program crash
PID:756
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:508
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8460" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8460" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4456
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7809" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:2196
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7809" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4944
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2913" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:1852
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:2224
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:1852
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:3532
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:3276
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:3836
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:4812
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
880KB
MD5bc1e43e5ab48ce5f339e46df2576c55b
SHA195d7fd5967ee2b373069c494c969f6154a0a83c2
SHA256cb2e6a89ea7fd8ed92119fdfad644ba2d93ce8823d14cce06ff25c843ecefa75
SHA512a565ec61a733fea1ca52a0483e905262af03506a5e7bc36a7b96105b7796153753b3cd88ba516395afe7eca31c7784d0636acf80dc8ec476f0803c963ea60d67
-
Filesize
880KB
MD5bc1e43e5ab48ce5f339e46df2576c55b
SHA195d7fd5967ee2b373069c494c969f6154a0a83c2
SHA256cb2e6a89ea7fd8ed92119fdfad644ba2d93ce8823d14cce06ff25c843ecefa75
SHA512a565ec61a733fea1ca52a0483e905262af03506a5e7bc36a7b96105b7796153753b3cd88ba516395afe7eca31c7784d0636acf80dc8ec476f0803c963ea60d67
-
Filesize
497B
MD513fda2ab01b83a5130842a5bab3892d3
SHA16e18e4b467cde054a63a95d4dfc030f156ecd215
SHA25676973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e
SHA512c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc
-
Filesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
Filesize
18KB
MD52e42a7a4091a5990b0fba82e1aa35692
SHA13c2d6898502e8fa11efd7bcc075651600d7e7587
SHA2568f97d3cb268a208dd22a93d5f50c883942df6555cc6d999f0b69b7167ab12015
SHA51263fb0ba742da6832dfa6d4069ef1d3662f36d21bc872784c0ed360d6bf94899f21a76b3a1b176ed4d16149ff7d02c311b68320eed627a6a2f3d89129cbc68df0