Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
22-09-2022 21:56
Behavioral task
behavioral1
Sample
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe
Resource
win7-20220812-en
General
-
Target
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe
-
Size
203KB
-
MD5
9a1daed01723b41412e6a08bc8db567e
-
SHA1
3a545bfb91498f474a18c93b56a4fdccff223e4a
-
SHA256
ed063805c13e47e8203bd5c1c8897ecf49cfe0be299028b57e859ab06e2a03df
-
SHA512
8f7b097cad343a2a99f35f3124dd6f7fc75c6d75d06e02f2229e84546fe661cdeff241bd6a31374bc7a50dfdfe131e9092b609d846e2292d440bf83f35bf39e3
-
SSDEEP
3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI/BDcdg0nZfileCvGZ49hpUOwC:sLV6Bta6dtJmakIM5iV0wQr8aOwC
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Monitor = "C:\\Program Files (x86)\\NTFS Monitor\\ntfsmon.exe" ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe -
Processes:
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe -
Drops file in Program Files directory 2 IoCs
Processes:
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exedescription ioc process File created C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe File opened for modification C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1448 schtasks.exe 1896 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exepid process 1492 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe 1492 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exepid process 1492 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exedescription pid process Token: SeDebugPrivilege 1492 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exedescription pid process target process PID 1492 wrote to memory of 1448 1492 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe schtasks.exe PID 1492 wrote to memory of 1448 1492 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe schtasks.exe PID 1492 wrote to memory of 1448 1492 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe schtasks.exe PID 1492 wrote to memory of 1448 1492 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe schtasks.exe PID 1492 wrote to memory of 1896 1492 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe schtasks.exe PID 1492 wrote to memory of 1896 1492 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe schtasks.exe PID 1492 wrote to memory of 1896 1492 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe schtasks.exe PID 1492 wrote to memory of 1896 1492 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe"C:\Users\Admin\AppData\Local\Temp\ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NTFS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB19.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NTFS Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD8A.tmp"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB19.tmpFilesize
1KB
MD5cd8f46e160739dd5b990f3a448184fb0
SHA12177de7fd1160be7b400590f6ae6fa8b8779dd99
SHA256824099d0c415f7bc462fafc728b8a3d16e631d928781bdb91ab5e3521fe1e0cb
SHA51219b8ee860d08c51a8c9075436c2039b4bb27aa74e40ebc9d226af683d937d070d77807dc634a1f71465db3e29c17c5fdbd468fe6e9084441f15f38511ff7b03b
-
C:\Users\Admin\AppData\Local\Temp\tmpD8A.tmpFilesize
1KB
MD5981e126601526eaa5b0ad45c496c4465
SHA1d610d6a21a8420cc73fcd3e54ddae75a5897b28b
SHA25611ae277dfa39e7038b782ca6557339e7fe88533fe83705c356a1500a1402d527
SHA512a59fb704d931ccb7e1ec1a7b98e24ccd8708be529066c6de4b673098cdebef539f7f50d9e051c43954b5a8e7f810862b3a4ede170f131e080dadc3e763ed4bdb
-
memory/1448-55-0x0000000000000000-mapping.dmp
-
memory/1492-54-0x0000000076121000-0x0000000076123000-memory.dmpFilesize
8KB
-
memory/1492-58-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1492-60-0x00000000748B0000-0x0000000074E5B000-memory.dmpFilesize
5.7MB
-
memory/1896-57-0x0000000000000000-mapping.dmp