Resubmissions
11-10-2022 04:47
221011-feqeysfcgp 810-10-2022 17:35
221010-v54slacfe3 828-09-2022 16:21
220928-ttpzmagec6 8Analysis
-
max time kernel
97s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 04:47
Static task
static1
Behavioral task
behavioral1
Sample
build3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
build3.exe
Resource
win10v2004-20220812-en
General
-
Target
build3.exe
-
Size
9KB
-
MD5
9ead10c08e72ae41921191f8db39bc16
-
SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1
-
SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
-
SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
SSDEEP
192:9UEc8b6H1LE+4LoGgMatAJ2lzUw317NyEpvNHhqyo:9UUE1BYoGza/D3170kiyo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
mstsca.exepid process 1516 mstsca.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1360 schtasks.exe 1284 schtasks.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
build3.exetaskeng.exemstsca.exedescription pid process target process PID 1972 wrote to memory of 1360 1972 build3.exe schtasks.exe PID 1972 wrote to memory of 1360 1972 build3.exe schtasks.exe PID 1972 wrote to memory of 1360 1972 build3.exe schtasks.exe PID 1972 wrote to memory of 1360 1972 build3.exe schtasks.exe PID 1616 wrote to memory of 1516 1616 taskeng.exe mstsca.exe PID 1616 wrote to memory of 1516 1616 taskeng.exe mstsca.exe PID 1616 wrote to memory of 1516 1616 taskeng.exe mstsca.exe PID 1616 wrote to memory of 1516 1616 taskeng.exe mstsca.exe PID 1516 wrote to memory of 1284 1516 mstsca.exe schtasks.exe PID 1516 wrote to memory of 1284 1516 mstsca.exe schtasks.exe PID 1516 wrote to memory of 1284 1516 mstsca.exe schtasks.exe PID 1516 wrote to memory of 1284 1516 mstsca.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\build3.exe"C:\Users\Admin\AppData\Local\Temp\build3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"2⤵
- Creates scheduled task(s)
PID:1360
-
C:\Windows\system32\taskeng.exetaskeng.exe {ABA13E8A-2F0F-49EC-BC26-8167C069E13F} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"3⤵
- Creates scheduled task(s)
PID:1284
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
memory/1284-60-0x0000000000000000-mapping.dmp
-
memory/1360-55-0x0000000000000000-mapping.dmp
-
memory/1516-57-0x0000000000000000-mapping.dmp
-
memory/1972-54-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB