47ddc1bf98157032d87569b52d6485e02b7f0c1ccf4e147f2855da3928c2d5f1

Analysis

max time kernel
53s
max time network
56s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05/05/2023, 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

m9142508.exe
Size

206KB
MD5

034ed82eecd4460c95f91180dc668618
SHA1

e04db896c61df47d10338feebbe7ed167d60b9de
SHA256

47ddc1bf98157032d87569b52d6485e02b7f0c1ccf4e147f2855da3928c2d5f1
SHA512

581a8f72070f848d17248bcd1469e93f06504cc3bca0064acf9ccff1de4a17e003c99e07361f3772839a8f7a6371bc7d2042724afbf0bb93e8cc16154003398f
SSDEEP

3072:mhMCsw9/w+A4cwP+5OzutpHKGruONM4QuZA+67bi83eILfbq5kmh:5Cswq+AXYu7HGOSuZAlAILjq

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1452	oneetx.exe
1440	oneetx.exe

Loads dropped DLL 5 IoCs

pid	Process
704	m9142508.exe
1724	rundll32.exe
1724	rundll32.exe
1724	rundll32.exe
1724	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
876	schtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
704	m9142508.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 1452	704	m9142508.exe	27
PID 704 wrote to memory of 1452	704	m9142508.exe	27
PID 704 wrote to memory of 1452	704	m9142508.exe	27
PID 704 wrote to memory of 1452	704	m9142508.exe	27
PID 1452 wrote to memory of 876	1452	oneetx.exe	28
PID 1452 wrote to memory of 876	1452	oneetx.exe	28
PID 1452 wrote to memory of 876	1452	oneetx.exe	28
PID 1452 wrote to memory of 876	1452	oneetx.exe	28
PID 1452 wrote to memory of 240	1452	oneetx.exe	30
PID 1452 wrote to memory of 240	1452	oneetx.exe	30
PID 1452 wrote to memory of 240	1452	oneetx.exe	30
PID 1452 wrote to memory of 240	1452	oneetx.exe	30
PID 240 wrote to memory of 1500	240	cmd.exe	32
PID 240 wrote to memory of 1500	240	cmd.exe	32
PID 240 wrote to memory of 1500	240	cmd.exe	32
PID 240 wrote to memory of 1500	240	cmd.exe	32
PID 240 wrote to memory of 108	240	cmd.exe	33
PID 240 wrote to memory of 108	240	cmd.exe	33
PID 240 wrote to memory of 108	240	cmd.exe	33
PID 240 wrote to memory of 108	240	cmd.exe	33
PID 240 wrote to memory of 1408	240	cmd.exe	34
PID 240 wrote to memory of 1408	240	cmd.exe	34
PID 240 wrote to memory of 1408	240	cmd.exe	34
PID 240 wrote to memory of 1408	240	cmd.exe	34
PID 240 wrote to memory of 1312	240	cmd.exe	35
PID 240 wrote to memory of 1312	240	cmd.exe	35
PID 240 wrote to memory of 1312	240	cmd.exe	35
PID 240 wrote to memory of 1312	240	cmd.exe	35
PID 240 wrote to memory of 1520	240	cmd.exe	36
PID 240 wrote to memory of 1520	240	cmd.exe	36
PID 240 wrote to memory of 1520	240	cmd.exe	36
PID 240 wrote to memory of 1520	240	cmd.exe	36
PID 240 wrote to memory of 628	240	cmd.exe	37
PID 240 wrote to memory of 628	240	cmd.exe	37
PID 240 wrote to memory of 628	240	cmd.exe	37
PID 240 wrote to memory of 628	240	cmd.exe	37
PID 1124 wrote to memory of 1440	1124	taskeng.exe	41
PID 1124 wrote to memory of 1440	1124	taskeng.exe	41
PID 1124 wrote to memory of 1440	1124	taskeng.exe	41
PID 1124 wrote to memory of 1440	1124	taskeng.exe	41
PID 1452 wrote to memory of 1724	1452	oneetx.exe	42
PID 1452 wrote to memory of 1724	1452	oneetx.exe	42
PID 1452 wrote to memory of 1724	1452	oneetx.exe	42
PID 1452 wrote to memory of 1724	1452	oneetx.exe	42
PID 1452 wrote to memory of 1724	1452	oneetx.exe	42
PID 1452 wrote to memory of 1724	1452	oneetx.exe	42
PID 1452 wrote to memory of 1724	1452	oneetx.exe	42

C:\Users\Admin\AppData\Local\Temp\m9142508.exe
"C:\Users\Admin\AppData\Local\Temp\m9142508.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:704
- C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
  "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:876
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:1500
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:N"
      4⤵
      PID:108
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:R" /E
      4⤵
      PID:1408
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:1312
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\c3912af058" /P "Admin:N"
      4⤵
      PID:1520
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\c3912af058" /P "Admin:R" /E
      4⤵
      PID:628
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:1724

C:\Windows\system32\taskeng.exe
taskeng.exe {2C8EE0CA-7E9C-4078-8BA4-372B78652449} S-1-5-21-1563773381-2037468142-1146002597-1000:YBHADZIG\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
  C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
  2⤵
  - Executes dropped EXE
  PID:1440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
206KB

MD5
034ed82eecd4460c95f91180dc668618

SHA1
e04db896c61df47d10338feebbe7ed167d60b9de

SHA256
47ddc1bf98157032d87569b52d6485e02b7f0c1ccf4e147f2855da3928c2d5f1

SHA512
581a8f72070f848d17248bcd1469e93f06504cc3bca0064acf9ccff1de4a17e003c99e07361f3772839a8f7a6371bc7d2042724afbf0bb93e8cc16154003398f

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
206KB

MD5
034ed82eecd4460c95f91180dc668618

SHA1
e04db896c61df47d10338feebbe7ed167d60b9de

SHA256
47ddc1bf98157032d87569b52d6485e02b7f0c1ccf4e147f2855da3928c2d5f1

SHA512
581a8f72070f848d17248bcd1469e93f06504cc3bca0064acf9ccff1de4a17e003c99e07361f3772839a8f7a6371bc7d2042724afbf0bb93e8cc16154003398f

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
206KB

MD5
034ed82eecd4460c95f91180dc668618

SHA1
e04db896c61df47d10338feebbe7ed167d60b9de

SHA256
47ddc1bf98157032d87569b52d6485e02b7f0c1ccf4e147f2855da3928c2d5f1

SHA512
581a8f72070f848d17248bcd1469e93f06504cc3bca0064acf9ccff1de4a17e003c99e07361f3772839a8f7a6371bc7d2042724afbf0bb93e8cc16154003398f

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
206KB

MD5
034ed82eecd4460c95f91180dc668618

SHA1
e04db896c61df47d10338feebbe7ed167d60b9de

SHA256
47ddc1bf98157032d87569b52d6485e02b7f0c1ccf4e147f2855da3928c2d5f1

SHA512
581a8f72070f848d17248bcd1469e93f06504cc3bca0064acf9ccff1de4a17e003c99e07361f3772839a8f7a6371bc7d2042724afbf0bb93e8cc16154003398f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
206KB

MD5
034ed82eecd4460c95f91180dc668618

SHA1
e04db896c61df47d10338feebbe7ed167d60b9de

SHA256
47ddc1bf98157032d87569b52d6485e02b7f0c1ccf4e147f2855da3928c2d5f1

SHA512
581a8f72070f848d17248bcd1469e93f06504cc3bca0064acf9ccff1de4a17e003c99e07361f3772839a8f7a6371bc7d2042724afbf0bb93e8cc16154003398f

Download Submit
\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads