Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08-10-2022 23:33

General

  • Target

    51fbd9b892ec6a9d9c66dc4c43a336f1f68822ed7f947addfaa4c4064f26e2d7.exe

  • Size

    733KB

  • MD5

    0aacf01f34faf19c9bbc0e7a1d6cadfc

  • SHA1

    c69cc95e0bd0cfc732684c49a3fe9d250bad04c0

  • SHA256

    51fbd9b892ec6a9d9c66dc4c43a336f1f68822ed7f947addfaa4c4064f26e2d7

  • SHA512

    b140b29eedaed53ffb6703d45e9b58f144ff505f5bd61015db167126ad7ef2aaaaa33a672d95588ae0cac51e4f3a04bc07eea23e53a487621ae2fd28355f8bcd

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51fbd9b892ec6a9d9c66dc4c43a336f1f68822ed7f947addfaa4c4064f26e2d7.exe
    "C:\Users\Admin\AppData\Local\Temp\51fbd9b892ec6a9d9c66dc4c43a336f1f68822ed7f947addfaa4c4064f26e2d7.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4148
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:1432
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5040
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:400
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1884
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1288
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:4692
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:3472
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:3292
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:4832
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:3596
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4764
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:4304
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:776
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2414" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:4264
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:3720
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3285" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        3⤵
                          PID:3856
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3191" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                          3⤵
                            PID:4988
                          • C:\Windows\SysWOW64\cmd.exe
                            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9060" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                            3⤵
                              PID:2220
                            • C:\Windows\SysWOW64\cmd.exe
                              "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3484
                              • C:\Windows\SysWOW64\chcp.com
                                chcp 1251
                                4⤵
                                  PID:4344
                              • C:\Windows\SysWOW64\cmd.exe
                                "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                                3⤵
                                  PID:4788
                                  • C:\Windows\SysWOW64\chcp.com
                                    chcp 1251
                                    4⤵
                                      PID:1796

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\ProgramData\Dllhost\dllhost.exe

                                Filesize

                                960KB

                                MD5

                                a0ab39a2d5ddf34264be20cc24e8f59f

                                SHA1

                                9ed17334867722f7708d90813eb96e547155370f

                                SHA256

                                463ecea6325f60cc96a94e71e48fa850642cdd8b60106f111360a13a25821ed5

                                SHA512

                                e5f445d463f90c5874fc9c9fadf95ced4686195292380e51142764450237b68d233906c0b5b91203cfae094ef29bc3296c9f2430e5e3790b571127791d2f3c6c

                              • C:\ProgramData\Dllhost\dllhost.exe

                                Filesize

                                960KB

                                MD5

                                a0ab39a2d5ddf34264be20cc24e8f59f

                                SHA1

                                9ed17334867722f7708d90813eb96e547155370f

                                SHA256

                                463ecea6325f60cc96a94e71e48fa850642cdd8b60106f111360a13a25821ed5

                                SHA512

                                e5f445d463f90c5874fc9c9fadf95ced4686195292380e51142764450237b68d233906c0b5b91203cfae094ef29bc3296c9f2430e5e3790b571127791d2f3c6c

                              • C:\ProgramData\HostData\logs.uce

                                Filesize

                                497B

                                MD5

                                13fda2ab01b83a5130842a5bab3892d3

                                SHA1

                                6e18e4b467cde054a63a95d4dfc030f156ecd215

                                SHA256

                                76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                                SHA512

                                c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                Filesize

                                2KB

                                MD5

                                db01a2c1c7e70b2b038edf8ad5ad9826

                                SHA1

                                540217c647a73bad8d8a79e3a0f3998b5abd199b

                                SHA256

                                413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

                                SHA512

                                c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Filesize

                                18KB

                                MD5

                                69e159bfa117fff8966d58be440bfd82

                                SHA1

                                0a6fa31ba95cb6bf97a6b8043ec72501e3012a70

                                SHA256

                                31c1511c091cd39065cd48969acae031de282ed190496e3b0c8dfd4a0ca3ac85

                                SHA512

                                891882cd20d349d0f2e18fe0b67d0c250dfef1cbd5cdf996f53c32269ed2b69c858200eead3a66df4fcca7e0c55bfbb42b856cfb3d065c6e15f2ce581f1fc696

                              • memory/400-710-0x0000000008230000-0x0000000008580000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/400-781-0x0000000009A20000-0x0000000009AC5000-memory.dmp

                                Filesize

                                660KB

                              • memory/400-525-0x0000000000000000-mapping.dmp

                              • memory/400-714-0x0000000008940000-0x000000000898B000-memory.dmp

                                Filesize

                                300KB

                              • memory/776-658-0x0000000000000000-mapping.dmp

                              • memory/1288-636-0x0000000000000000-mapping.dmp

                              • memory/1432-179-0x0000000000000000-mapping.dmp

                              • memory/1432-185-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/1432-182-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/1432-181-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/1432-180-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/1432-184-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/1432-183-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/1432-186-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/1796-1087-0x0000000000000000-mapping.dmp

                              • memory/1884-600-0x0000000000F40000-0x0000000000FF0000-memory.dmp

                                Filesize

                                704KB

                              • memory/1884-528-0x0000000000000000-mapping.dmp

                              • memory/2196-168-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-124-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-136-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-137-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-138-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-139-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-140-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-141-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-142-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-143-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-144-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-145-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-146-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-147-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-148-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-149-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-150-0x0000000000B90000-0x0000000000C38000-memory.dmp

                                Filesize

                                672KB

                              • memory/2196-151-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-152-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-153-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-154-0x0000000005A90000-0x0000000005F8E000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/2196-155-0x0000000005490000-0x0000000005522000-memory.dmp

                                Filesize

                                584KB

                              • memory/2196-156-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-157-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-158-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-160-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-159-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-161-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-162-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-163-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-164-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-165-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-166-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-167-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-134-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-169-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-170-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-171-0x0000000005460000-0x000000000546A000-memory.dmp

                                Filesize

                                40KB

                              • memory/2196-172-0x0000000005710000-0x0000000005776000-memory.dmp

                                Filesize

                                408KB

                              • memory/2196-117-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-133-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-132-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-131-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-118-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-119-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-120-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-121-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-122-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-123-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-135-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-125-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-126-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-127-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-128-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-129-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2196-130-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2220-678-0x0000000000000000-mapping.dmp

                              • memory/3292-644-0x0000000000000000-mapping.dmp

                              • memory/3472-638-0x0000000000000000-mapping.dmp

                              • memory/3484-1054-0x0000000000000000-mapping.dmp

                              • memory/3596-640-0x0000000000000000-mapping.dmp

                              • memory/3720-663-0x0000000000000000-mapping.dmp

                              • memory/3856-673-0x0000000000000000-mapping.dmp

                              • memory/4148-177-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4148-176-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4148-178-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4148-173-0x0000000000000000-mapping.dmp

                              • memory/4148-175-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4148-174-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4264-668-0x0000000000000000-mapping.dmp

                              • memory/4304-723-0x0000000000000000-mapping.dmp

                              • memory/4344-1060-0x0000000000000000-mapping.dmp

                              • memory/4692-713-0x0000000000000000-mapping.dmp

                              • memory/4764-653-0x0000000000000000-mapping.dmp

                              • memory/4788-1081-0x0000000000000000-mapping.dmp

                              • memory/4832-649-0x0000000000000000-mapping.dmp

                              • memory/4988-683-0x0000000000000000-mapping.dmp

                              • memory/5040-264-0x0000000008350000-0x00000000086A0000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/5040-259-0x0000000008050000-0x00000000080B6000-memory.dmp

                                Filesize

                                408KB

                              • memory/5040-223-0x0000000005170000-0x00000000051A6000-memory.dmp

                                Filesize

                                216KB

                              • memory/5040-228-0x00000000079B0000-0x0000000007FD8000-memory.dmp

                                Filesize

                                6.2MB

                              • memory/5040-267-0x0000000008100000-0x000000000811C000-memory.dmp

                                Filesize

                                112KB

                              • memory/5040-256-0x00000000078B0000-0x00000000078D2000-memory.dmp

                                Filesize

                                136KB

                              • memory/5040-188-0x0000000077660000-0x00000000777EE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/5040-268-0x0000000008720000-0x000000000876B000-memory.dmp

                                Filesize

                                300KB

                              • memory/5040-187-0x0000000000000000-mapping.dmp

                              • memory/5040-507-0x0000000009910000-0x0000000009918000-memory.dmp

                                Filesize

                                32KB

                              • memory/5040-502-0x0000000009920000-0x000000000993A000-memory.dmp

                                Filesize

                                104KB

                              • memory/5040-299-0x0000000009DD0000-0x0000000009E64000-memory.dmp

                                Filesize

                                592KB

                              • memory/5040-295-0x0000000009C40000-0x0000000009CE5000-memory.dmp

                                Filesize

                                660KB

                              • memory/5040-286-0x00000000098A0000-0x00000000098BE000-memory.dmp

                                Filesize

                                120KB

                              • memory/5040-285-0x00000000098C0000-0x00000000098F3000-memory.dmp

                                Filesize

                                204KB

                              • memory/5040-272-0x00000000089A0000-0x0000000008A16000-memory.dmp

                                Filesize

                                472KB