Resubmissions

15-11-2022 04:10

221115-ervd1aeh46 7

15-11-2022 03:41

221115-d86ypaeg75 7

Analysis

  • max time kernel
    51s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    15-11-2022 03:41

General

  • Target

    39d3df8f4a3bacaf1456712177c36f4fd76acf69a174c74927c15442bc80a398.exe

  • Size

    6.1MB

  • MD5

    4475d543fd30e39295790f0f766dfcd7

  • SHA1

    bd9b5b090c3c3c86be2c4e7fbe587918c2be4ef8

  • SHA256

    39d3df8f4a3bacaf1456712177c36f4fd76acf69a174c74927c15442bc80a398

  • SHA512

    55d292cd3ae08ff96981ded66828c333783bce2775c4581826be564211df500fa08474990c675ea145eb2702833e618b06038e7594d343234b4bdfb4b8983a7b

  • SSDEEP

    98304:fO/zQnFA/Cv9sATR/yl9zqE4C5J+daIhtoO9Ekm6tGEvZb:f8Q62CATR/yl9+ErefXB636I8

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39d3df8f4a3bacaf1456712177c36f4fd76acf69a174c74927c15442bc80a398.exe
    "C:\Users\Admin\AppData\Local\Temp\39d3df8f4a3bacaf1456712177c36f4fd76acf69a174c74927c15442bc80a398.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1324
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /TN "Windows\IntelComputingToolkit\IntelGAS0.9.2.4." /TR "C:\ProgramData\lntelToolSkits\IntelGAS-Ver0.9.2.4.exe" /SC MINUTE
      2⤵
      • Creates scheduled task(s)
      PID:2040
    • C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\ProgramData\lntelToolSkits" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
      2⤵
      • Modifies file permissions
      PID:1212
    • C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\ProgramData\lntelToolSkits" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
      2⤵
      • Modifies file permissions
      PID:1760
    • C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\System32\icacls.exe" "C:\ProgramData\lntelToolSkits" /inheritance:e /deny "adMnepoxyFEYWGOLmin:(R,REA,RA,RD)"
      2⤵
      • Modifies file permissions
      PID:1752
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {C2C1E2BA-8519-409F-8120-7F0F1F92BA25} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
    1⤵
      PID:1724
      • C:\ProgramData\lntelToolSkits\IntelGAS-Ver0.9.2.4.exe
        C:\ProgramData\lntelToolSkits\IntelGAS-Ver0.9.2.4.exe
        2⤵
          PID:1544

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      File Permissions Modification

      1
      T1222

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\lntelToolSkits\IntelGAS-Ver0.9.2.4.exe
        Filesize

        1053.4MB

        MD5

        4805ef98b18cebbcafb404a6fe6946e8

        SHA1

        61add7f917a1608351eb02bbda7a2704e773286d

        SHA256

        9755506846790d1d7d466d267937f6090e2dc9c7266287be35c926ff71e5e04d

        SHA512

        c4c1a2808de3acf29b42ecf1664e12add3be9e9f08d0f55d947821b99df493093e775b95f0465b61018260fbf5425a0b7a7f1f3763b0e51f45702b713d3593cf

      • C:\ProgramData\lntelToolSkits\IntelGAS-Ver0.9.2.4.exe
        Filesize

        1053.4MB

        MD5

        4805ef98b18cebbcafb404a6fe6946e8

        SHA1

        61add7f917a1608351eb02bbda7a2704e773286d

        SHA256

        9755506846790d1d7d466d267937f6090e2dc9c7266287be35c926ff71e5e04d

        SHA512

        c4c1a2808de3acf29b42ecf1664e12add3be9e9f08d0f55d947821b99df493093e775b95f0465b61018260fbf5425a0b7a7f1f3763b0e51f45702b713d3593cf

      • memory/1212-60-0x0000000000000000-mapping.dmp
      • memory/1324-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp
        Filesize

        8KB

      • memory/1324-55-0x0000000000400000-0x0000000000DA3000-memory.dmp
        Filesize

        9.6MB

      • memory/1324-58-0x0000000000400000-0x0000000000DA3000-memory.dmp
        Filesize

        9.6MB

      • memory/1324-64-0x0000000000400000-0x0000000000DA3000-memory.dmp
        Filesize

        9.6MB

      • memory/1544-65-0x0000000000000000-mapping.dmp
      • memory/1752-63-0x0000000000000000-mapping.dmp
      • memory/1760-62-0x0000000000000000-mapping.dmp
      • memory/2040-59-0x0000000000000000-mapping.dmp