124c17b099d8c09db4bd82b5ef3d41cea61727a480abfd56a943208d858ea8cf

General

Target

taskshostw.exe
Size

245KB
MD5

e538f67d529d672c55304f3c9ad05392
SHA1

f7ff40a1901d51dd6222b420bbece575b46b2cd2
SHA256

124c17b099d8c09db4bd82b5ef3d41cea61727a480abfd56a943208d858ea8cf
SHA512

22344125223dcc5d66a5d0a6b860e547b408123d75e3d8f698fa45b9ea33e7a736ccaa7ae4e32a0989a9d0637db16443502e7bd56beb8093bb6c09a0289361c6
SSDEEP

3072:eTIu4ZQ8M2A1vA7m5+C6ZoEHBAnpK37nXz8o1008Q75wPsoB74tyJhvSK/KkMc/X:LHA1vweOR8CTwPnLKkM/u

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

taskshostw.exetaskshostw.exe

pid process

276 taskshostw.exe
396 taskshostw.exe
Drops startup file 1 IoCs

Processes:

taskshostw.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskshostw.exe taskshostw.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
276	taskshostw.exe
396	taskshostw.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskshostw.exe	taskshostw.exe

flow	ioc
7	ip-api.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

taskshostw.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	taskshostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	taskshostw.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1496 schtasks.exe

pid	process
1496	schtasks.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

taskshostw.exetaskshostw.exetaskshostw.exe

description	pid	process
Token: SeDebugPrivilege	980	taskshostw.exe
Token: SeDebugPrivilege	980	taskshostw.exe
Token: SeDebugPrivilege	276	taskshostw.exe
Token: SeDebugPrivilege	396	taskshostw.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

taskshostw.exetaskeng.exe

description	pid	process	target process
PID 980 wrote to memory of 1496	980	taskshostw.exe	schtasks.exe
PID 980 wrote to memory of 1496	980	taskshostw.exe	schtasks.exe
PID 980 wrote to memory of 1496	980	taskshostw.exe	schtasks.exe
PID 1624 wrote to memory of 276	1624	taskeng.exe	taskshostw.exe
PID 1624 wrote to memory of 276	1624	taskeng.exe	taskshostw.exe
PID 1624 wrote to memory of 276	1624	taskeng.exe	taskshostw.exe
PID 1624 wrote to memory of 396	1624	taskeng.exe	taskshostw.exe
PID 1624 wrote to memory of 396	1624	taskeng.exe	taskshostw.exe
PID 1624 wrote to memory of 396	1624	taskeng.exe	taskshostw.exe

C:\Users\Admin\AppData\Local\Temp\taskshostw.exe
"C:\Users\Admin\AppData\Local\Temp\taskshostw.exe"
1⤵
- Drops startup file
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "taskshostw" /tr "C:\Users\Admin\AppData\Roaming\taskshostw.exe"
2⤵
- Creates scheduled task(s)
PID:1496

C:\Windows\system32\taskeng.exe
taskeng.exe {55AFD7DD-29A3-44F0-9DB6-396D04EFB098} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Users\Admin\AppData\Roaming\taskshostw.exe
C:\Users\Admin\AppData\Roaming\taskshostw.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:276

C:\Users\Admin\AppData\Roaming\taskshostw.exe
C:\Users\Admin\AppData\Roaming\taskshostw.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\taskshostw.exe

Filesize
245KB

MD5
e538f67d529d672c55304f3c9ad05392

SHA1
f7ff40a1901d51dd6222b420bbece575b46b2cd2

SHA256
124c17b099d8c09db4bd82b5ef3d41cea61727a480abfd56a943208d858ea8cf

SHA512
22344125223dcc5d66a5d0a6b860e547b408123d75e3d8f698fa45b9ea33e7a736ccaa7ae4e32a0989a9d0637db16443502e7bd56beb8093bb6c09a0289361c6

Download Submit
C:\Users\Admin\AppData\Roaming\taskshostw.exe

Filesize
245KB

MD5
e538f67d529d672c55304f3c9ad05392

SHA1
f7ff40a1901d51dd6222b420bbece575b46b2cd2

SHA256
124c17b099d8c09db4bd82b5ef3d41cea61727a480abfd56a943208d858ea8cf

SHA512
22344125223dcc5d66a5d0a6b860e547b408123d75e3d8f698fa45b9ea33e7a736ccaa7ae4e32a0989a9d0637db16443502e7bd56beb8093bb6c09a0289361c6

Download Submit
C:\Users\Admin\AppData\Roaming\taskshostw.exe

Filesize
245KB

MD5
e538f67d529d672c55304f3c9ad05392

SHA1
f7ff40a1901d51dd6222b420bbece575b46b2cd2

SHA256
124c17b099d8c09db4bd82b5ef3d41cea61727a480abfd56a943208d858ea8cf

SHA512
22344125223dcc5d66a5d0a6b860e547b408123d75e3d8f698fa45b9ea33e7a736ccaa7ae4e32a0989a9d0637db16443502e7bd56beb8093bb6c09a0289361c6

Download Submit
memory/276-58-0x0000000000000000-mapping.dmp

Download
memory/276-61-0x0000000000FE0000-0x0000000001024000-memory.dmp

Filesize
272KB

Download
memory/396-62-0x0000000000000000-mapping.dmp

Download
memory/396-64-0x00000000011B0000-0x00000000011F4000-memory.dmp

Filesize
272KB

Download
memory/980-54-0x0000000000F80000-0x0000000000FC4000-memory.dmp

Filesize
272KB

Download
memory/980-55-0x00000000003F0000-0x0000000000402000-memory.dmp

Filesize
72KB

Download
memory/980-56-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/1496-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads