39cc2423c2cd157014637802833c3b70f9b6cc5ff3e3247b15949eded3cb8d62

General

Target

UNNAMED3.exe
Size

9.1MB
MD5

223ce6bb95cc6072b3c08cdcdf6b2944
SHA1

a55afd57e0862347574680bda2ea42ccb6c31bce
SHA256

39cc2423c2cd157014637802833c3b70f9b6cc5ff3e3247b15949eded3cb8d62
SHA512

a34ecf9dc5dae22f37d3697a5c4050261ca98f22f3f88108c9c63f02911fe64ed1be9b8608211b8440cb19fd5dbac423d1bbe1c5e70f2e31f0043b8ebbd4daa6
SSDEEP

196608:u4Fk4ptoPqwTIr2TLd6bHpYLCWcOge52Tmt6qR5bar/ytJGuDrLygLgF:BFTptrzgLsOWOgED5Rxarat2

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

Processes:

UNNAMED3.exe

description	pid	process	target process
PID 1648 created 1372	1648	UNNAMED3.exe	Explorer.EXE
PID 1648 created 1372	1648	UNNAMED3.exe	Explorer.EXE
PID 1648 created 1372	1648	UNNAMED3.exe	Explorer.EXE
PID 1648 created 1372	1648	UNNAMED3.exe	Explorer.EXE
PID 1648 created 1372	1648	UNNAMED3.exe	Explorer.EXE

Drops file in Drivers directory 1 IoCs

Processes:

UNNAMED3.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts UNNAMED3.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1520 cmd.exe

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	UNNAMED3.exe

pid	process
1520	cmd.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

UNNAMED3.exe

pid process

1648 UNNAMED3.exe
1648 UNNAMED3.exe
Drops file in Program Files directory 1 IoCs

Processes:

UNNAMED3.exe

description ioc process

File created C:\Program Files\Google\chromeupdater.exe UNNAMED3.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1764 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

UNNAMED3.exepowershell.exepowershell.exe

pid process

1648 UNNAMED3.exe
1648 UNNAMED3.exe
1884 powershell.exe
1648 UNNAMED3.exe
1648 UNNAMED3.exe
1760 powershell.exe
1648 UNNAMED3.exe
1648 UNNAMED3.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1884 powershell.exe
Token: SeDebugPrivilege 1760 powershell.exe

pid	process
1648	UNNAMED3.exe
1648	UNNAMED3.exe

description	ioc	process
File created	C:\Program Files\Google\chromeupdater.exe	UNNAMED3.exe

pid	process
1764	schtasks.exe

pid	process
1648	UNNAMED3.exe
1648	UNNAMED3.exe
1884	powershell.exe
1648	UNNAMED3.exe
1648	UNNAMED3.exe
1760	powershell.exe
1648	UNNAMED3.exe
1648	UNNAMED3.exe

description	pid	process
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeDebugPrivilege	1760	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.execmd.exe

description	pid	process	target process
PID 1760 wrote to memory of 1764	1760	powershell.exe	schtasks.exe
PID 1760 wrote to memory of 1764	1760	powershell.exe	schtasks.exe
PID 1760 wrote to memory of 1764	1760	powershell.exe	schtasks.exe
PID 1520 wrote to memory of 1880	1520	cmd.exe	choice.exe
PID 1520 wrote to memory of 1880	1520	cmd.exe	choice.exe
PID 1520 wrote to memory of 1880	1520	cmd.exe	choice.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1372

C:\Users\Admin\AppData\Local\Temp\UNNAMED3.exe
"C:\Users\Admin\AppData\Local\Temp\UNNAMED3.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1648

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe <#thakcjdi#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'Google' /tr '''C:\Program Files\Google\chromeupdater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\chromeupdater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Google' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Google" /t REG_SZ /f /d 'C:\Program Files\Google\chromeupdater.exe' }
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn Google /tr "'C:\Program Files\Google\chromeupdater.exe'"
3⤵
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\UNNAMED3.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:1880

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
908364966f7607342ceaedc8d3f9bb5e

SHA1
813cd9dd4782530b3f3289bcbef8cfe776ece098

SHA256
afcb96f58a3017eee4d04ee06013b465aadcb4908608ece2bb63d2d8f8616fa7

SHA512
176a85f480e4cbbda08dac14948c3711c4440d98b4bdeada1fa486c8bb7c2fb9f4f49787b01d7226ed5291a5179f5e7b05942094e702694f6f5ef300921c0a13

Download Submit
memory/1648-57-0x000000013F8C0000-0x000000014089C000-memory.dmp

Filesize
15.9MB

Download
memory/1648-73-0x000000013F8C0000-0x000000014089C000-memory.dmp

Filesize
15.9MB

Download
memory/1648-54-0x000000013F8C0000-0x000000014089C000-memory.dmp

Filesize
15.9MB

Download
memory/1760-67-0x0000000002454000-0x0000000002457000-memory.dmp

Filesize
12KB

Download
memory/1760-71-0x000000000245B000-0x000000000247A000-memory.dmp

Filesize
124KB

Download
memory/1760-70-0x0000000002454000-0x0000000002457000-memory.dmp

Filesize
12KB

Download
memory/1760-68-0x000000000245B000-0x000000000247A000-memory.dmp

Filesize
124KB

Download
memory/1760-65-0x000007FEF3F50000-0x000007FEF4973000-memory.dmp

Filesize
10.1MB

Download
memory/1760-66-0x000007FEF33F0000-0x000007FEF3F4D000-memory.dmp

Filesize
11.4MB

Download
memory/1764-69-0x0000000000000000-mapping.dmp

Download
memory/1880-72-0x0000000000000000-mapping.dmp

Download
memory/1884-62-0x00000000023BB000-0x00000000023DA000-memory.dmp

Filesize
124KB

Download
memory/1884-61-0x00000000023B4000-0x00000000023B7000-memory.dmp

Filesize
12KB

Download
memory/1884-60-0x000007FEF2A50000-0x000007FEF35AD000-memory.dmp

Filesize
11.4MB

Download
memory/1884-59-0x000007FEF35B0000-0x000007FEF3FD3000-memory.dmp

Filesize
10.1MB

Download
memory/1884-58-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads