Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17/09/2022, 05:39

General

  • Target

    19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250.exe

  • Size

    719KB

  • MD5

    98d2184f4e2245b62d7409a3a7cbab41

  • SHA1

    682a129d5151d6a80772a2cf29ecc1e649c968c1

  • SHA256

    19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250

  • SHA512

    58e4121b758af949235516bb4d5b3ead8f49654941d7fc3db6341a3175ff4f58f199c1ff68ee9200b5c98ad1ddbf1a7886dfcb86643598c884d604846427d625

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250.exe
    "C:\Users\Admin\AppData\Local\Temp\19501d5a972a87d753d9b016bc26f39095d5fb0d733f46ed54c3d341b97a8250.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3316
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:3580
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1560
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3040
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4300
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1432
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:3836
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:368
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:4944
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:4696
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4432
            • C:\Windows\SysWOW64\schtasks.exe
              SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Creates scheduled task(s)
              PID:4736
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:4492
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:660
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:4636
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6132" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:1324
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4016" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:3292
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk82" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:328
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk88" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2192
                    • C:\Windows\SysWOW64\schtasks.exe
                      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk88" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      4⤵
                      • Creates scheduled task(s)
                      PID:3564
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:1908
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:4896
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                        3⤵
                          PID:1800
                          • C:\Windows\SysWOW64\chcp.com
                            chcp 1251
                            4⤵
                              PID:2124
                          • C:\Windows\SysWOW64\cmd.exe
                            "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                            3⤵
                              PID:832
                              • C:\Windows\SysWOW64\chcp.com
                                chcp 1251
                                4⤵
                                  PID:1640
                              • C:\Windows\SysWOW64\cmd.exe
                                "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                                3⤵
                                  PID:1256
                                  • C:\Windows\SysWOW64\chcp.com
                                    chcp 1251
                                    4⤵
                                      PID:4780

                              Network

                                    MITRE ATT&CK Enterprise v6

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\ProgramData\Dllhost\dllhost.exe

                                      Filesize

                                      902KB

                                      MD5

                                      e0eb584cff07c230b8452215da8dba6a

                                      SHA1

                                      6b164dfe92f08ca9b6254eab9a7221e8f185e335

                                      SHA256

                                      0ce9225873e5093d9cb79a153e38240b6d264f54758f933bcff597b1ddc1f4a8

                                      SHA512

                                      86f67cf4fb1568dc2d6d2dcb6c1a3a02a52cdda882a15b983cba18ae3e0c571ce95156ca89e6bb5b94423da69c82ec279807d36f17f4f0139d6aae1d08b3b181

                                    • C:\ProgramData\Dllhost\dllhost.exe

                                      Filesize

                                      902KB

                                      MD5

                                      e0eb584cff07c230b8452215da8dba6a

                                      SHA1

                                      6b164dfe92f08ca9b6254eab9a7221e8f185e335

                                      SHA256

                                      0ce9225873e5093d9cb79a153e38240b6d264f54758f933bcff597b1ddc1f4a8

                                      SHA512

                                      86f67cf4fb1568dc2d6d2dcb6c1a3a02a52cdda882a15b983cba18ae3e0c571ce95156ca89e6bb5b94423da69c82ec279807d36f17f4f0139d6aae1d08b3b181

                                    • C:\ProgramData\HostData\logs.uce

                                      Filesize

                                      497B

                                      MD5

                                      13fda2ab01b83a5130842a5bab3892d3

                                      SHA1

                                      6e18e4b467cde054a63a95d4dfc030f156ecd215

                                      SHA256

                                      76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                                      SHA512

                                      c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                      Filesize

                                      2KB

                                      MD5

                                      1c19c16e21c97ed42d5beabc93391fc5

                                      SHA1

                                      8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                      SHA256

                                      1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                      SHA512

                                      7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      18KB

                                      MD5

                                      b789b0dc77e5ebb9e378da98648687ef

                                      SHA1

                                      146eab1023bf71746425a9cf8941a94d7bee721f

                                      SHA256

                                      e2ba8e2460e3d1dfac0d9c7be470df4e6508900c3786ba74428e1e37d4b4a9ad

                                      SHA512

                                      e1ac310c0259d0e4387ae20e73e4b259d1ce762905d9d8088cb37188a8efe6d9c3535b452f9760a691447c8b795365bb53747c21ae64b9671eb12d7f4939e48c

                                    • memory/1412-175-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1412-174-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1412-177-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1412-176-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1412-178-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1560-228-0x0000000007400000-0x0000000007A28000-memory.dmp

                                      Filesize

                                      6.2MB

                                    • memory/1560-267-0x0000000008110000-0x000000000812C000-memory.dmp

                                      Filesize

                                      112KB

                                    • memory/1560-507-0x0000000009890000-0x0000000009898000-memory.dmp

                                      Filesize

                                      32KB

                                    • memory/1560-502-0x00000000098A0000-0x00000000098BA000-memory.dmp

                                      Filesize

                                      104KB

                                    • memory/1560-299-0x0000000009900000-0x0000000009994000-memory.dmp

                                      Filesize

                                      592KB

                                    • memory/1560-295-0x0000000009650000-0x00000000096F5000-memory.dmp

                                      Filesize

                                      660KB

                                    • memory/1560-286-0x00000000095F0000-0x000000000960E000-memory.dmp

                                      Filesize

                                      120KB

                                    • memory/1560-285-0x0000000009610000-0x0000000009643000-memory.dmp

                                      Filesize

                                      204KB

                                    • memory/1560-272-0x00000000084D0000-0x0000000008546000-memory.dmp

                                      Filesize

                                      472KB

                                    • memory/1560-268-0x0000000008730000-0x000000000877B000-memory.dmp

                                      Filesize

                                      300KB

                                    • memory/1560-188-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1560-261-0x0000000007DA0000-0x00000000080F0000-memory.dmp

                                      Filesize

                                      3.3MB

                                    • memory/1560-256-0x0000000007C30000-0x0000000007C96000-memory.dmp

                                      Filesize

                                      408KB

                                    • memory/1560-251-0x0000000007AB0000-0x0000000007AD2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/1560-223-0x0000000006D90000-0x0000000006DC6000-memory.dmp

                                      Filesize

                                      216KB

                                    • memory/3316-158-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-145-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-160-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-161-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-162-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-163-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-164-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-165-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-166-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-167-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-168-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-169-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-118-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-171-0x0000000004A30000-0x0000000004A3A000-memory.dmp

                                      Filesize

                                      40KB

                                    • memory/3316-172-0x0000000004B60000-0x0000000004BC6000-memory.dmp

                                      Filesize

                                      408KB

                                    • memory/3316-119-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-157-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-117-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-156-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-155-0x0000000004A50000-0x0000000004AE2000-memory.dmp

                                      Filesize

                                      584KB

                                    • memory/3316-154-0x0000000004F50000-0x000000000544E000-memory.dmp

                                      Filesize

                                      5.0MB

                                    • memory/3316-131-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-170-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-129-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-130-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-132-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-120-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-133-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-134-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-153-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-152-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-151-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-150-0x0000000000090000-0x0000000000138000-memory.dmp

                                      Filesize

                                      672KB

                                    • memory/3316-149-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-148-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-147-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-146-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-159-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-144-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-143-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-142-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-141-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-140-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-139-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-138-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-137-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-128-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-127-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-121-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-126-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-125-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-135-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-124-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-136-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-123-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3316-122-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3580-181-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3580-186-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3580-180-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3580-182-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3580-185-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3580-184-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/3580-183-0x00000000771E0000-0x000000007736E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/4300-739-0x0000000000710000-0x00000000007C0000-memory.dmp

                                      Filesize

                                      704KB