Analysis
-
max time kernel
51s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
15-11-2022 03:41
Static task
static1
Behavioral task
behavioral1
Sample
39d3df8f4a3bacaf1456712177c36f4fd76acf69a174c74927c15442bc80a398.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
39d3df8f4a3bacaf1456712177c36f4fd76acf69a174c74927c15442bc80a398.exe
Resource
win10-20220812-en
General
-
Target
39d3df8f4a3bacaf1456712177c36f4fd76acf69a174c74927c15442bc80a398.exe
-
Size
6.1MB
-
MD5
4475d543fd30e39295790f0f766dfcd7
-
SHA1
bd9b5b090c3c3c86be2c4e7fbe587918c2be4ef8
-
SHA256
39d3df8f4a3bacaf1456712177c36f4fd76acf69a174c74927c15442bc80a398
-
SHA512
55d292cd3ae08ff96981ded66828c333783bce2775c4581826be564211df500fa08474990c675ea145eb2702833e618b06038e7594d343234b4bdfb4b8983a7b
-
SSDEEP
98304:fO/zQnFA/Cv9sATR/yl9zqE4C5J+daIhtoO9Ekm6tGEvZb:f8Q62CATR/yl9+ErefXB636I8
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 3 IoCs
Processes:
icacls.exeicacls.exeicacls.exepid process 1212 icacls.exe 1760 icacls.exe 1752 icacls.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
39d3df8f4a3bacaf1456712177c36f4fd76acf69a174c74927c15442bc80a398.exepid process 1324 39d3df8f4a3bacaf1456712177c36f4fd76acf69a174c74927c15442bc80a398.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39d3df8f4a3bacaf1456712177c36f4fd76acf69a174c74927c15442bc80a398.exe"C:\Users\Admin\AppData\Local\Temp\39d3df8f4a3bacaf1456712177c36f4fd76acf69a174c74927c15442bc80a398.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "Windows\IntelComputingToolkit\IntelGAS0.9.2.4." /TR "C:\ProgramData\lntelToolSkits\IntelGAS-Ver0.9.2.4.exe" /SC MINUTE2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\lntelToolSkits" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"2⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\lntelToolSkits" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"2⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\lntelToolSkits" /inheritance:e /deny "adMnepoxyFEYWGOLmin:(R,REA,RA,RD)"2⤵
- Modifies file permissions
-
C:\Windows\system32\taskeng.exetaskeng.exe {C2C1E2BA-8519-409F-8120-7F0F1F92BA25} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]1⤵
-
C:\ProgramData\lntelToolSkits\IntelGAS-Ver0.9.2.4.exeC:\ProgramData\lntelToolSkits\IntelGAS-Ver0.9.2.4.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\lntelToolSkits\IntelGAS-Ver0.9.2.4.exeFilesize
1053.4MB
MD54805ef98b18cebbcafb404a6fe6946e8
SHA161add7f917a1608351eb02bbda7a2704e773286d
SHA2569755506846790d1d7d466d267937f6090e2dc9c7266287be35c926ff71e5e04d
SHA512c4c1a2808de3acf29b42ecf1664e12add3be9e9f08d0f55d947821b99df493093e775b95f0465b61018260fbf5425a0b7a7f1f3763b0e51f45702b713d3593cf
-
C:\ProgramData\lntelToolSkits\IntelGAS-Ver0.9.2.4.exeFilesize
1053.4MB
MD54805ef98b18cebbcafb404a6fe6946e8
SHA161add7f917a1608351eb02bbda7a2704e773286d
SHA2569755506846790d1d7d466d267937f6090e2dc9c7266287be35c926ff71e5e04d
SHA512c4c1a2808de3acf29b42ecf1664e12add3be9e9f08d0f55d947821b99df493093e775b95f0465b61018260fbf5425a0b7a7f1f3763b0e51f45702b713d3593cf
-
memory/1212-60-0x0000000000000000-mapping.dmp
-
memory/1324-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmpFilesize
8KB
-
memory/1324-55-0x0000000000400000-0x0000000000DA3000-memory.dmpFilesize
9.6MB
-
memory/1324-58-0x0000000000400000-0x0000000000DA3000-memory.dmpFilesize
9.6MB
-
memory/1324-64-0x0000000000400000-0x0000000000DA3000-memory.dmpFilesize
9.6MB
-
memory/1544-65-0x0000000000000000-mapping.dmp
-
memory/1752-63-0x0000000000000000-mapping.dmp
-
memory/1760-62-0x0000000000000000-mapping.dmp
-
memory/2040-59-0x0000000000000000-mapping.dmp