8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2

General

Target

8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2.exe
Size

104KB
MD5

4271ddb1f84839372933e92564f4dbe0
SHA1

ee65d610a67c3e5ffe74af70b0060041029e8d39
SHA256

8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2
SHA512

871b2e441bd06965fa4423402db4f3e85d39996f50c13b37276c2ce5d5958561f887a545e326e3e272796bfac1af6d17c86533a2b5744076128e2fee7c8878e5
SSDEEP

3072:t/XeyKeGzuut/S1PkP7ov3cxgTSgyuXH:hobuC61PkP7ov3cxg1

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

schedule.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\System32\\schedule.exe"	schedule.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

schedule.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "2"	schedule.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "2"	schedule.exe

Modifies system executable filetype association 2 TTPs 1 IoCs
persistence

Modify Registry
T1112

Change Default File Association
T1042

Processes:

schedule.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "Microsoft Word Document" schedule.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "Microsoft Word Document"	schedule.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

schedule.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	schedule.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

schedule.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	schedule.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

schedule.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	schedule.exe

Disables Task Manager via registry modification
evasion
Executes dropped EXE 1 IoCs

Processes:

schedule.exe

pid process

1840 schedule.exe

pid	process
1840	schedule.exe

Drops file in System32 directory 4 IoCs

Processes:

8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\schedule.exe	8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2.exe
File created	C:\Windows\SysWOW64\count.txt	8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2.exe
File opened for modification	C:\Windows\SysWOW64\count.txt	8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2.exe
File created	C:\Windows\SysWOW64\schedule.exe	8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2.exe

Modifies registry class 2 IoCs

Processes:

schedule.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	schedule.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "Microsoft Word Document"	schedule.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2.exeschedule.exe

pid process

392 8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2.exe
1840 schedule.exe

pid	process
392	8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2.exe
1840	schedule.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2.exe

description	pid	process	target process
PID 392 wrote to memory of 1840	392	8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2.exe	schedule.exe
PID 392 wrote to memory of 1840	392	8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2.exe	schedule.exe
PID 392 wrote to memory of 1840	392	8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2.exe	schedule.exe

C:\Users\Admin\AppData\Local\Temp\8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2.exe
"C:\Users\Admin\AppData\Local\Temp\8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\SysWOW64\schedule.exe
C:\Windows\System32\schedule.exe
2⤵
- Modifies WinLogon for persistence
- Modifies security service
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Hidden Files and Directories

2

T1158

Modify Existing Service

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\count.txt

Filesize
17B

MD5
59af00188ab9c2d0f6b306e17daed2f5

SHA1
b00e36cbef67a9a441def3281aa09549c19afb2e

SHA256
996077594a2bb9154afe9274e319ca35fc2eb9060b2d4c5cdf1cf7cc58eca9af

SHA512
d797996e1d6332b5a2e85cec0e29efe6df9b32f2e1d229fa77a4390044274a0fd7625031dda3437f049c1d4fa18aa2de73447293fa78dfc0fc1c719dad2b662f

Download Submit
C:\Windows\SysWOW64\schedule.exe

Filesize
104KB

MD5
4271ddb1f84839372933e92564f4dbe0

SHA1
ee65d610a67c3e5ffe74af70b0060041029e8d39

SHA256
8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2

SHA512
871b2e441bd06965fa4423402db4f3e85d39996f50c13b37276c2ce5d5958561f887a545e326e3e272796bfac1af6d17c86533a2b5744076128e2fee7c8878e5

Download Submit
C:\Windows\SysWOW64\schedule.exe

Filesize
104KB

MD5
4271ddb1f84839372933e92564f4dbe0

SHA1
ee65d610a67c3e5ffe74af70b0060041029e8d39

SHA256
8a74fd1de988ea633b469b7708274289f29ea40a7fecc7b6f5663b32dc9577a2

SHA512
871b2e441bd06965fa4423402db4f3e85d39996f50c13b37276c2ce5d5958561f887a545e326e3e272796bfac1af6d17c86533a2b5744076128e2fee7c8878e5

Download Submit
memory/1840-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads