4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972

General

Target

4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe
Size

2.2MB
MD5

1b72c735aa2a283dea732c51b159ef0f
SHA1

6d6d4a832c4e1c3d058a23b98d88dc05592e5993
SHA256

4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972
SHA512

acc6cc23825bef18626fb10afc4f268f99536276359a377a049cda730843a3b99573b81e3728e89ce4c4aadec3fadf925dd5cbe5b4ce1ef407c66ab71191a612
SSDEEP

49152:1TSgc8bKieeH3g6m+aJ/O8lBO+1iVQ+ixu7RdZT:pSgcIw6m+aJ/O8lBOwZxu7lT

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
276	eventvwr.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1520	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe
276	eventvwr.exe
276	eventvwr.exe
276	eventvwr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1076	1520	WerFault.exe	27

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1656	schtasks.exe
1032	schtasks.exe
1200	schtasks.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1520	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe
276	eventvwr.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1656	1520	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	28
PID 1520 wrote to memory of 1656	1520	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	28
PID 1520 wrote to memory of 1656	1520	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	28
PID 1520 wrote to memory of 1656	1520	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	28
PID 1520 wrote to memory of 1716	1520	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	30
PID 1520 wrote to memory of 1716	1520	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	30
PID 1520 wrote to memory of 1716	1520	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	30
PID 1520 wrote to memory of 1716	1520	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	30
PID 1520 wrote to memory of 1076	1520	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	33
PID 1520 wrote to memory of 1076	1520	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	33
PID 1520 wrote to memory of 1076	1520	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	33
PID 1520 wrote to memory of 1076	1520	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	33
PID 828 wrote to memory of 276	828	taskeng.exe	35
PID 828 wrote to memory of 276	828	taskeng.exe	35
PID 828 wrote to memory of 276	828	taskeng.exe	35
PID 828 wrote to memory of 276	828	taskeng.exe	35
PID 276 wrote to memory of 1200	276	eventvwr.exe	36
PID 276 wrote to memory of 1200	276	eventvwr.exe	36
PID 276 wrote to memory of 1200	276	eventvwr.exe	36
PID 276 wrote to memory of 1200	276	eventvwr.exe	36

C:\Users\Admin\AppData\Local\Temp\4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe
"C:\Users\Admin\AppData\Local\Temp\4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 5 /tn "Event Viewer Snap-in Launcher (29762912)" /tr "C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1656
- C:\Windows\SysWOW64\schtasks.exe
  /C /Query /XML /TN "Event Viewer Snap-in Launcher (29762912)"
  2⤵
  PID:1716
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /tn "Event Viewer Snap-in Launcher (29762912)" /XML "C:\Users\Admin\AppData\Roaming\EventViewer\tfnme73946158264.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 300
  2⤵
  - Program crash
  PID:1076

C:\Windows\system32\taskeng.exe
taskeng.exe {0253D43F-DD72-4A06-9E52-75D8AB40143F} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe
  C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:276
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 5 /tn "Event Viewer Snap-in Launcher (29762912)" /tr "C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe

Filesize
2.2MB

MD5
1b72c735aa2a283dea732c51b159ef0f

SHA1
6d6d4a832c4e1c3d058a23b98d88dc05592e5993

SHA256
4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972

SHA512
acc6cc23825bef18626fb10afc4f268f99536276359a377a049cda730843a3b99573b81e3728e89ce4c4aadec3fadf925dd5cbe5b4ce1ef407c66ab71191a612

Download Submit
C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe

Filesize
2.2MB

MD5
1b72c735aa2a283dea732c51b159ef0f

SHA1
6d6d4a832c4e1c3d058a23b98d88dc05592e5993

SHA256
4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972

SHA512
acc6cc23825bef18626fb10afc4f268f99536276359a377a049cda730843a3b99573b81e3728e89ce4c4aadec3fadf925dd5cbe5b4ce1ef407c66ab71191a612

Download Submit
memory/276-67-0x0000000001120000-0x0000000001A8B000-memory.dmp

Filesize
9.4MB

Download
memory/276-66-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/276-65-0x0000000001120000-0x0000000001A8B000-memory.dmp

Filesize
9.4MB

Download
memory/1520-59-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1520-58-0x0000000001090000-0x00000000019FB000-memory.dmp

Filesize
9.4MB

Download
memory/1520-54-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads