3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1

General

Target

3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe
Size

6.6MB
MD5

64ed37feac61cb606a9900101ee7c63d
SHA1

1c25c01722d48dcb13f4e10f7d4b57ad8d2fdca7
SHA256

3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1
SHA512

1281e696d00b59a9133074c94d2770b28179ae0d722284a2171d1c4c6b554bab7b4effaba9040e58fff353ac36ae478e42c951c391d03de27befb48f1d19d1f5
SSDEEP

98304:bXDG+r4fVLlai166tW4GV05oRAMJZdyE6lFVkKVi8pM1q8dZn5O4prrgrstJai2t:bwVBGUoRJJZd0AK4Z1VZc4Bryni2wsr

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
968	eventvwr.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
748	3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe
748	3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe
968	eventvwr.exe
968	eventvwr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	748	WerFault.exe	26

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1948	schtasks.exe
1724	schtasks.exe
1916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
748	3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe
968	eventvwr.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1948	748	3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe	27
PID 748 wrote to memory of 1948	748	3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe	27
PID 748 wrote to memory of 1948	748	3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe	27
PID 748 wrote to memory of 1948	748	3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe	27
PID 748 wrote to memory of 2032	748	3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe	29
PID 748 wrote to memory of 2032	748	3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe	29
PID 748 wrote to memory of 2032	748	3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe	29
PID 748 wrote to memory of 2032	748	3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe	29
PID 748 wrote to memory of 1984	748	3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe	32
PID 748 wrote to memory of 1984	748	3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe	32
PID 748 wrote to memory of 1984	748	3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe	32
PID 748 wrote to memory of 1984	748	3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe	32
PID 920 wrote to memory of 968	920	taskeng.exe	34
PID 920 wrote to memory of 968	920	taskeng.exe	34
PID 920 wrote to memory of 968	920	taskeng.exe	34
PID 920 wrote to memory of 968	920	taskeng.exe	34
PID 968 wrote to memory of 1916	968	eventvwr.exe	35
PID 968 wrote to memory of 1916	968	eventvwr.exe	35
PID 968 wrote to memory of 1916	968	eventvwr.exe	35
PID 968 wrote to memory of 1916	968	eventvwr.exe	35

C:\Users\Admin\AppData\Local\Temp\3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe
"C:\Users\Admin\AppData\Local\Temp\3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 5 /tn "Event Viewer Snap-in Launcher (29762912)" /tr "C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1948
- C:\Windows\SysWOW64\schtasks.exe
  /C /Query /XML /TN "Event Viewer Snap-in Launcher (29762912)"
  2⤵
  PID:2032
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /tn "Event Viewer Snap-in Launcher (29762912)" /XML "C:\Users\Admin\AppData\Roaming\EventViewer\tfnme73946158264.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 188
  2⤵
  - Program crash
  PID:1984

C:\Windows\system32\taskeng.exe
taskeng.exe {ABEFC5E8-C95F-41A4-810B-BD2C04259146} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:920
- C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe
  C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 5 /tn "Event Viewer Snap-in Launcher (29762912)" /tr "C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe

Filesize
6.6MB

MD5
64ed37feac61cb606a9900101ee7c63d

SHA1
1c25c01722d48dcb13f4e10f7d4b57ad8d2fdca7

SHA256
3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1

SHA512
1281e696d00b59a9133074c94d2770b28179ae0d722284a2171d1c4c6b554bab7b4effaba9040e58fff353ac36ae478e42c951c391d03de27befb48f1d19d1f5

Download Submit
C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe

Filesize
6.6MB

MD5
64ed37feac61cb606a9900101ee7c63d

SHA1
1c25c01722d48dcb13f4e10f7d4b57ad8d2fdca7

SHA256
3c72a30189b975fcc76c4ab85cc2568207baa293e1ee6b7d83f7f9b3589c33d1

SHA512
1281e696d00b59a9133074c94d2770b28179ae0d722284a2171d1c4c6b554bab7b4effaba9040e58fff353ac36ae478e42c951c391d03de27befb48f1d19d1f5

Download Submit
memory/748-55-0x0000000000240000-0x0000000000C8A000-memory.dmp

Filesize
10.3MB

Download
memory/748-56-0x0000000000240000-0x0000000000C8A000-memory.dmp

Filesize
10.3MB

Download
memory/748-54-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download
memory/748-58-0x0000000000240000-0x0000000000C8A000-memory.dmp

Filesize
10.3MB

Download
memory/968-65-0x0000000001380000-0x0000000001DCA000-memory.dmp

Filesize
10.3MB

Download
memory/968-67-0x0000000001380000-0x0000000001DCA000-memory.dmp

Filesize
10.3MB

Download
memory/968-62-0x0000000000000000-mapping.dmp

Download
memory/1916-66-0x0000000000000000-mapping.dmp

Download
memory/1948-57-0x0000000000000000-mapping.dmp

Download
memory/1984-60-0x0000000000000000-mapping.dmp

Download
memory/2032-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads