Analysis

  • max time kernel
    52s
  • max time network
    113s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27/09/2022, 19:33

General

  • Target

    cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe

  • Size

    931KB

  • MD5

    a22d477ad6e6a40ca99ec8c1bb2d93e4

  • SHA1

    7e4eed7dbf4d848a1704247d4d895b96db7a3ce2

  • SHA256

    cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975

  • SHA512

    0e558d8b95230f375362fb3d5d87918d3a7dd46f321e6b27f3a56635b617524c7ed54e2a20cda41f617ab42da7be207e6a916c31e19b2ef79183c2789a68da0f

  • SSDEEP

    768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 9 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe
    "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
      2⤵
        PID:3300
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4736
        • C:\Windows\SysWOW64\schtasks.exe
          SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
          3⤵
          • Creates scheduled task(s)
          PID:4776
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2104
        • C:\Windows\SysWOW64\schtasks.exe
          SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
          3⤵
          • Creates scheduled task(s)
          PID:3928
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4748
        • C:\Windows\SysWOW64\schtasks.exe
          SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
          3⤵
          • Creates scheduled task(s)
          PID:3964
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4792
        • C:\Windows\SysWOW64\schtasks.exe
          SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
          3⤵
          • Creates scheduled task(s)
          PID:4816
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4804
        • C:\Windows\SysWOW64\schtasks.exe
          SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
          3⤵
          • Creates scheduled task(s)
          PID:2280
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
        2⤵
          PID:5100
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4340
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
            3⤵
            • Creates scheduled task(s)
            PID:4536
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4895" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3404
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4895" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
            3⤵
            • Creates scheduled task(s)
            PID:3868
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk4495" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
          2⤵
            PID:4276
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk2002" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
            2⤵
              PID:1520
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5053" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"
              2⤵
                PID:2972
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 1360
                2⤵
                • Program crash
                PID:400

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2104-174-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2104-178-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2104-187-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2104-182-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-154-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-160-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-121-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-122-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-123-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-124-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-125-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-126-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-127-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-128-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-129-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-130-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-131-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-132-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-133-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-134-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-157-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-136-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-137-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-138-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-139-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-140-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-141-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-142-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-159-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-144-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-145-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-146-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-147-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-148-0x00000000009F0000-0x0000000000AA0000-memory.dmp

              Filesize

              704KB

            • memory/2660-149-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-150-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-151-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-152-0x0000000005820000-0x0000000005D1E000-memory.dmp

              Filesize

              5.0MB

            • memory/2660-153-0x0000000005320000-0x00000000053B2000-memory.dmp

              Filesize

              584KB

            • memory/2660-119-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-155-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-156-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-135-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-120-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-143-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-158-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-162-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-161-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-163-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-164-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-165-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-166-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-167-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-168-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-169-0x00000000052C0000-0x00000000052CA000-memory.dmp

              Filesize

              40KB

            • memory/2660-115-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-116-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-117-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/2660-118-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/3300-176-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/3300-172-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/3300-186-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/3300-181-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/4736-179-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/4736-185-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/4736-175-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/4748-183-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB

            • memory/4792-189-0x0000000077A00000-0x0000000077B8E000-memory.dmp

              Filesize

              1.6MB