4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972

Analysis

max time kernel
292s
max time network
181s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
24-09-2022 10:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe
Size

2.2MB
MD5

1b72c735aa2a283dea732c51b159ef0f
SHA1

6d6d4a832c4e1c3d058a23b98d88dc05592e5993
SHA256

4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972
SHA512

acc6cc23825bef18626fb10afc4f268f99536276359a377a049cda730843a3b99573b81e3728e89ce4c4aadec3fadf925dd5cbe5b4ce1ef407c66ab71191a612
SSDEEP

49152:1TSgc8bKieeH3g6m+aJ/O8lBO+1iVQ+ixu7RdZT:pSgcIw6m+aJ/O8lBOwZxu7lT

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4800	eventvwr.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2700	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe
2700	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe
4800	eventvwr.exe
4800	eventvwr.exe
4800	eventvwr.exe
4800	eventvwr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1364	2700	WerFault.exe	65

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4084	schtasks.exe
3572	schtasks.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2700	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe
4800	eventvwr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 4084	2700	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	67
PID 2700 wrote to memory of 4084	2700	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	67
PID 2700 wrote to memory of 4084	2700	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	67
PID 2700 wrote to memory of 5004	2700	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	69
PID 2700 wrote to memory of 5004	2700	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	69
PID 2700 wrote to memory of 5004	2700	4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe	69
PID 4800 wrote to memory of 3572	4800	eventvwr.exe	74
PID 4800 wrote to memory of 3572	4800	eventvwr.exe	74
PID 4800 wrote to memory of 3572	4800	eventvwr.exe	74

C:\Users\Admin\AppData\Local\Temp\4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe
"C:\Users\Admin\AppData\Local\Temp\4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 5 /tn "Event Viewer Snap-in Launcher (29762912)" /tr "C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe"
  2⤵
  - Creates scheduled task(s)
  PID:4084
- C:\Windows\SysWOW64\schtasks.exe
  /C /Query /XML /TN "Event Viewer Snap-in Launcher (29762912)"
  2⤵
  PID:5004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 688
  2⤵
  - Program crash
  PID:1364

C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe
C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 5 /tn "Event Viewer Snap-in Launcher (29762912)" /tr "C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe

Filesize
2.2MB

MD5
1b72c735aa2a283dea732c51b159ef0f

SHA1
6d6d4a832c4e1c3d058a23b98d88dc05592e5993

SHA256
4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972

SHA512
acc6cc23825bef18626fb10afc4f268f99536276359a377a049cda730843a3b99573b81e3728e89ce4c4aadec3fadf925dd5cbe5b4ce1ef407c66ab71191a612

Download Submit
C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe

Filesize
2.2MB

MD5
1b72c735aa2a283dea732c51b159ef0f

SHA1
6d6d4a832c4e1c3d058a23b98d88dc05592e5993

SHA256
4e7a39e2f461ea256e7361e9ac7377ea8f082754e7640698ccf349df5af98972

SHA512
acc6cc23825bef18626fb10afc4f268f99536276359a377a049cda730843a3b99573b81e3728e89ce4c4aadec3fadf925dd5cbe5b4ce1ef407c66ab71191a612

Download Submit
memory/2700-152-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-139-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-120-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-121-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-123-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-117-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-124-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-125-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-126-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-128-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-127-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-131-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-132-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-133-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-135-0x00000000012F0000-0x0000000001C5B000-memory.dmp

Filesize
9.4MB

Download
memory/2700-134-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-136-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-137-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-138-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-171-0x000000007E790000-0x000000007EB61000-memory.dmp

Filesize
3.8MB

Download
memory/2700-140-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-141-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-142-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-143-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-144-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-145-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-129-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-130-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-146-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-148-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-147-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-149-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-150-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-151-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-116-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-153-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-122-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-119-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-118-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-192-0x00000000012F0000-0x0000000001C5B000-memory.dmp

Filesize
9.4MB

Download
memory/4084-173-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-160-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-162-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-164-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-167-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-168-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-157-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-165-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-163-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-158-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-169-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-156-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-170-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-172-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-155-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-161-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-166-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4084-159-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-251-0x000000007E9F0000-0x000000007EDC1000-memory.dmp

Filesize
3.8MB

Download
memory/4800-252-0x0000000001380000-0x0000000001CEB000-memory.dmp

Filesize
9.4MB

Download
memory/4800-250-0x0000000001380000-0x0000000001CEB000-memory.dmp

Filesize
9.4MB

Download
memory/5004-181-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/5004-183-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/5004-182-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/5004-179-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/5004-180-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/5004-178-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/5004-177-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/5004-176-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/5004-175-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads