30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d

Analysis

max time kernel
53s
max time network
147s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01-11-2022 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe
Size

325KB
MD5

48349ba91d79b3e02e8590674813e0e5
SHA1

edf0a7b3fc7d96369510c814c1597a96685ae5dc
SHA256

30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d
SHA512

03c7051fdd5021eb064f18ccac18aba7bfdd288065df6dc90200b401f9fd7625f054cb2fbe08421020ccc8181633156a2f64ad2ed7bbc3c99a70a7b958ccb2b1
SSDEEP

6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4368 set thread context of 1412	4368	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	68

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5084	schtasks.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4600	4368	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	67
PID 4368 wrote to memory of 4600	4368	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	67
PID 4368 wrote to memory of 4600	4368	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	67
PID 4368 wrote to memory of 1412	4368	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	68
PID 4368 wrote to memory of 1412	4368	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	68
PID 4368 wrote to memory of 1412	4368	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	68
PID 4368 wrote to memory of 1412	4368	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	68
PID 4368 wrote to memory of 1412	4368	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	68
PID 4368 wrote to memory of 1412	4368	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	68
PID 4368 wrote to memory of 1412	4368	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	68
PID 4368 wrote to memory of 1412	4368	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	68
PID 4368 wrote to memory of 1412	4368	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	68
PID 1412 wrote to memory of 5084	1412	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	69
PID 1412 wrote to memory of 5084	1412	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	69
PID 1412 wrote to memory of 5084	1412	30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe	69

C:\Users\Admin\AppData\Local\Temp\30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe
"C:\Users\Admin\AppData\Local\Temp\30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe
  C:\Users\Admin\AppData\Local\Temp\30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe
  2⤵
  PID:4600
- C:\Users\Admin\AppData\Local\Temp\30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe
  C:\Users\Admin\AppData\Local\Temp\30ff4a0ff40b16c383af9a4fe2d6b265347423657de73e7f0992737389c08d1d.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:5084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1412-174-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1412-175-0x0000000000402354-mapping.dmp

Download
memory/1412-176-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/1412-177-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/1412-178-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/1412-228-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1412-187-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/1412-186-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/1412-185-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/1412-184-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/1412-183-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/1412-182-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/1412-179-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-147-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-153-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-126-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-127-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-128-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-130-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-129-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-131-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-132-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-133-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-134-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-135-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-136-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-137-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-138-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-139-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-140-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-141-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-142-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-143-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-144-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-145-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-146-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-124-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-148-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-149-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-150-0x00000000001A0000-0x00000000001F6000-memory.dmp

Filesize
344KB

Download
memory/4368-151-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-152-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-125-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-154-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-155-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-156-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-157-0x0000000006F30000-0x0000000006FFC000-memory.dmp

Filesize
816KB

Download
memory/4368-158-0x0000000007500000-0x00000000079FE000-memory.dmp

Filesize
5.0MB

Download
memory/4368-159-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-160-0x00000000070A0000-0x0000000007132000-memory.dmp

Filesize
584KB

Download
memory/4368-161-0x0000000000BD0000-0x0000000000BD6000-memory.dmp

Filesize
24KB

Download
memory/4368-162-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-163-0x0000000007000000-0x0000000007076000-memory.dmp

Filesize
472KB

Download
memory/4368-164-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-165-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-166-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-167-0x0000000004B40000-0x0000000004B5E000-memory.dmp

Filesize
120KB

Download
memory/4368-168-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-169-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-170-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-171-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-172-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-173-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-180-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-123-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-122-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-121-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-120-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-119-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-118-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-117-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/4368-116-0x0000000077520000-0x00000000776AE000-memory.dmp

Filesize
1.6MB

Download
memory/5084-209-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads