0571364098f40a3c60009ed794c6bba0375711d6b8cc697c9114df8ea4150b15

Analysis

max time kernel
258s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2022 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11379015582786627911.exe
Size

6.6MB
MD5

a2d7280fb1a88819932e1a73a38542f0
SHA1

0682680b071988c34e3c8eecb12aafd7df4ade0d
SHA256

0571364098f40a3c60009ed794c6bba0375711d6b8cc697c9114df8ea4150b15
SHA512

c0aa6c3bf1023c5bddd29563e30f007f87d3aace715081e178d0d7f85f245f0494d908eb3e371e8580778bda239587b3d738e9a08756ea22f7ef14731de5e830
SSDEEP

196608:CTLUG3f2675rSEEfCEQlj3QnXF0zswkLdKSEtaC:CXnf2675rYAGUdSRC

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4260	PerfWatson2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1360	11379015582786627911.exe
1360	11379015582786627911.exe
4260	PerfWatson2.exe
4260	PerfWatson2.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1420	schtasks.exe
4432	schtasks.exe
3320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1360	11379015582786627911.exe
1360	11379015582786627911.exe
4260	PerfWatson2.exe
4260	PerfWatson2.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 1420	1360	11379015582786627911.exe	84
PID 1360 wrote to memory of 1420	1360	11379015582786627911.exe	84
PID 1360 wrote to memory of 1420	1360	11379015582786627911.exe	84
PID 1360 wrote to memory of 4384	1360	11379015582786627911.exe	86
PID 1360 wrote to memory of 4384	1360	11379015582786627911.exe	86
PID 1360 wrote to memory of 4384	1360	11379015582786627911.exe	86
PID 1360 wrote to memory of 4432	1360	11379015582786627911.exe	88
PID 1360 wrote to memory of 4432	1360	11379015582786627911.exe	88
PID 1360 wrote to memory of 4432	1360	11379015582786627911.exe	88
PID 4260 wrote to memory of 3320	4260	PerfWatson2.exe	110
PID 4260 wrote to memory of 3320	4260	PerfWatson2.exe	110
PID 4260 wrote to memory of 3320	4260	PerfWatson2.exe	110

C:\Users\Admin\AppData\Local\Temp\11379015582786627911.exe
"C:\Users\Admin\AppData\Local\Temp\11379015582786627911.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 5 /tn "PerformanceMonitor_{Y6F7A6L1Q3V2W4S7}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\PerfWatson2.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1420
- C:\Windows\SysWOW64\schtasks.exe
  /C /Query /XML /TN "PerformanceMonitor_{Y6F7A6L1Q3V2W4S7}"
  2⤵
  PID:4384
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /tn "PerformanceMonitor_{Y6F7A6L1Q3V2W4S7}" /XML "C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\1201824912038.xml"
  2⤵
  - Creates scheduled task(s)
  PID:4432

C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\PerfWatson2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\PerfWatson2.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 5 /tn "PerformanceMonitor_{Y6F7A6L1Q3V2W4S7}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\PerfWatson2.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\1201824912038.xml

Filesize
1KB

MD5
4925fe91707c4fb47b99719cc584b37c

SHA1
fad7542db133cbfafcd7f7f2c26698aa289940ea

SHA256
d0c9233e4feebb2044943574fe1b4e3318a0fd58338538c7f240db54323fc602

SHA512
a292fa5356d04d2f51f5e1cb1e0aac53798bd6465dd39a57510e76b23d83f7f6aeb5129ecf8041ad0447bb5082d96802906cb94c32ad38cf7207bad039e75519

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\PerfWatson2.exe

Filesize
6.6MB

MD5
a2d7280fb1a88819932e1a73a38542f0

SHA1
0682680b071988c34e3c8eecb12aafd7df4ade0d

SHA256
0571364098f40a3c60009ed794c6bba0375711d6b8cc697c9114df8ea4150b15

SHA512
c0aa6c3bf1023c5bddd29563e30f007f87d3aace715081e178d0d7f85f245f0494d908eb3e371e8580778bda239587b3d738e9a08756ea22f7ef14731de5e830

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\PerfMon\PerfWatson2.exe

Filesize
6.6MB

MD5
a2d7280fb1a88819932e1a73a38542f0

SHA1
0682680b071988c34e3c8eecb12aafd7df4ade0d

SHA256
0571364098f40a3c60009ed794c6bba0375711d6b8cc697c9114df8ea4150b15

SHA512
c0aa6c3bf1023c5bddd29563e30f007f87d3aace715081e178d0d7f85f245f0494d908eb3e371e8580778bda239587b3d738e9a08756ea22f7ef14731de5e830

Download Submit
memory/1360-132-0x00000000005F0000-0x0000000001029000-memory.dmp

Filesize
10.2MB

Download
memory/1360-134-0x00000000005F0000-0x0000000001029000-memory.dmp

Filesize
10.2MB

Download
memory/1360-138-0x00000000005F0000-0x0000000001029000-memory.dmp

Filesize
10.2MB

Download
memory/4260-141-0x0000000000350000-0x0000000000D89000-memory.dmp

Filesize
10.2MB

Download
memory/4260-143-0x0000000000350000-0x0000000000D89000-memory.dmp

Filesize
10.2MB

Download