Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2022 21:57
Behavioral task
behavioral1
Sample
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe
Resource
win7-20220901-en
General
-
Target
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe
-
Size
203KB
-
MD5
9a1daed01723b41412e6a08bc8db567e
-
SHA1
3a545bfb91498f474a18c93b56a4fdccff223e4a
-
SHA256
ed063805c13e47e8203bd5c1c8897ecf49cfe0be299028b57e859ab06e2a03df
-
SHA512
8f7b097cad343a2a99f35f3124dd6f7fc75c6d75d06e02f2229e84546fe661cdeff241bd6a31374bc7a50dfdfe131e9092b609d846e2292d440bf83f35bf39e3
-
SSDEEP
3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI/BDcdg0nZfileCvGZ49hpUOwC:sLV6Bta6dtJmakIM5iV0wQr8aOwC
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Manager = "C:\\Program Files (x86)\\DDP Manager\\ddpmgr.exe" ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe -
Processes:
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe -
Drops file in Program Files directory 2 IoCs
Processes:
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exedescription ioc process File created C:\Program Files (x86)\DDP Manager\ddpmgr.exe ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe File opened for modification C:\Program Files (x86)\DDP Manager\ddpmgr.exe ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exepid process 868 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe 868 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe 868 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exepid process 868 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exedescription pid process Token: SeDebugPrivilege 868 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exedescription pid process target process PID 868 wrote to memory of 808 868 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe schtasks.exe PID 868 wrote to memory of 808 868 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe schtasks.exe PID 868 wrote to memory of 808 868 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe schtasks.exe PID 868 wrote to memory of 5048 868 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe schtasks.exe PID 868 wrote to memory of 5048 868 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe schtasks.exe PID 868 wrote to memory of 5048 868 ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe"C:\Users\Admin\AppData\Local\Temp\ED063805C13E47E8203BD5C1C8897ECF49CFE0BE29902.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC4DB.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC6EF.tmp"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC4DB.tmpFilesize
1KB
MD5cd8f46e160739dd5b990f3a448184fb0
SHA12177de7fd1160be7b400590f6ae6fa8b8779dd99
SHA256824099d0c415f7bc462fafc728b8a3d16e631d928781bdb91ab5e3521fe1e0cb
SHA51219b8ee860d08c51a8c9075436c2039b4bb27aa74e40ebc9d226af683d937d070d77807dc634a1f71465db3e29c17c5fdbd468fe6e9084441f15f38511ff7b03b
-
C:\Users\Admin\AppData\Local\Temp\tmpC6EF.tmpFilesize
1KB
MD5677848190631e19222304d1982aa2e1b
SHA1bed6cf97d3458e4ea59ff9823375d915a9b3d682
SHA2568bcf16c788d228932fa707bb4250c05151e099bdf7040adc717e53680601be3d
SHA512f5d41e150011bc63f4c95799e21fe91ffaa25eb05f4ca46ea89f3a3ca5325413ba4e0b7b5d69c0bc189955f3308c4928016a7cc1d6f7c2352639106952e92b1e
-
memory/808-133-0x0000000000000000-mapping.dmp
-
memory/868-132-0x0000000074900000-0x0000000074EB1000-memory.dmpFilesize
5.7MB
-
memory/868-137-0x0000000074900000-0x0000000074EB1000-memory.dmpFilesize
5.7MB
-
memory/5048-135-0x0000000000000000-mapping.dmp