8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

Resubmissions

11-10-2022 04:47

221011-feqeysfcgp 8

10-10-2022 17:35

221010-v54slacfe3 8

28-09-2022 16:21

220928-ttpzmagec6 8

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10-10-2022 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

build3.exe
Size

9KB
MD5

9ead10c08e72ae41921191f8db39bc16
SHA1

abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA256

8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512

aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
SSDEEP

192:9UEc8b6H1LE+4LoGgMatAJ2lzUw317NyEpvNHhqyo:9UUE1BYoGza/D3170kiyo

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

mstsca.exe

pid process

2032 mstsca.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1012 schtasks.exe
968 schtasks.exe

pid	process
2032	mstsca.exe

pid	process
1012	schtasks.exe
968	schtasks.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

build3.exetaskeng.exemstsca.exe

description	pid	process	target process
PID 1912 wrote to memory of 1012	1912	build3.exe	schtasks.exe
PID 1912 wrote to memory of 1012	1912	build3.exe	schtasks.exe
PID 1912 wrote to memory of 1012	1912	build3.exe	schtasks.exe
PID 1912 wrote to memory of 1012	1912	build3.exe	schtasks.exe
PID 1232 wrote to memory of 2032	1232	taskeng.exe	mstsca.exe
PID 1232 wrote to memory of 2032	1232	taskeng.exe	mstsca.exe
PID 1232 wrote to memory of 2032	1232	taskeng.exe	mstsca.exe
PID 1232 wrote to memory of 2032	1232	taskeng.exe	mstsca.exe
PID 2032 wrote to memory of 968	2032	mstsca.exe	schtasks.exe
PID 2032 wrote to memory of 968	2032	mstsca.exe	schtasks.exe
PID 2032 wrote to memory of 968	2032	mstsca.exe	schtasks.exe
PID 2032 wrote to memory of 968	2032	mstsca.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\build3.exe
"C:\Users\Admin\AppData\Local\Temp\build3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
2⤵
- Creates scheduled task(s)
PID:1012

C:\Windows\system32\taskeng.exe
taskeng.exe {54A40627-259C-4223-8B8A-3E5093BFE48B} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1232

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
3⤵
- Creates scheduled task(s)
PID:968

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
memory/968-60-0x0000000000000000-mapping.dmp

Download
memory/1012-55-0x0000000000000000-mapping.dmp

Download
memory/1912-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/2032-57-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads