Analysis

  • max time kernel
    90s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/09/2022, 01:25

General

  • Target

    89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe

  • Size

    904KB

  • MD5

    01b58dadfcaa4902f44d9b8283051a35

  • SHA1

    f7a6b33063fe9f2087846f557cb3076186a3aa63

  • SHA256

    89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa

  • SHA512

    c0908257914e439c80126a1a4cfbc5c2ba27ee1e2554b5b32fa34580f0cf074ffb2e4fbbf3e4e34379c4f4df10e696e36a03c7267dd7c4d5e37ba22eaf703a4d

  • SSDEEP

    768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 9 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe
    "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
        3⤵
        • Creates scheduled task(s)
        PID:2836
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3708
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4948
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
        3⤵
        • Creates scheduled task(s)
        PID:180
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4904
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3652
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2288
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3764
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:448
      • C:\Windows\SysWOW64\schtasks.exe
        SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3832
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9826" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
      2⤵
        PID:3164
        • C:\Windows\SysWOW64\schtasks.exe
          SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9826" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
          3⤵
          • Creates scheduled task(s)
          PID:2916
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4058" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
        2⤵
          PID:3804
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4058" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
            3⤵
            • Creates scheduled task(s)
            PID:2372
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9734" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:764
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9734" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
            3⤵
            • Creates scheduled task(s)
            PID:2924
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8133" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4436
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8133" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
            3⤵
            • Creates scheduled task(s)
            PID:3044
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4832
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
            3⤵
            • Creates scheduled task(s)
            PID:2316
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:668
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"
            3⤵
            • Creates scheduled task(s)
            PID:116
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1444
          2⤵
          • Program crash
          PID:3420
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4696 -ip 4696
        1⤵
          PID:4796

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4696-132-0x0000000000780000-0x0000000000830000-memory.dmp

          Filesize

          704KB

        • memory/4696-135-0x0000000005270000-0x000000000527A000-memory.dmp

          Filesize

          40KB

        • memory/4696-134-0x00000000051C0000-0x0000000005252000-memory.dmp

          Filesize

          584KB

        • memory/4696-133-0x0000000005850000-0x0000000005DF4000-memory.dmp

          Filesize

          5.6MB