Analysis
-
max time kernel
282s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08/05/2023, 22:17
Static task
static1
Behavioral task
behavioral1
Sample
0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe
Resource
win10-20230220-en
General
-
Target
0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe
-
Size
6.0MB
-
MD5
88e6deee81ba6c70e517b7b4dcf56b5e
-
SHA1
ba7c697fe8cab422e273115383a607dcdaf40079
-
SHA256
0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3
-
SHA512
3dca60a81d2871e2005fe0413b04d1ea60a88ed75e149a57628dad2693248797e2e1dece4b680855bd739e95168bc091be39673d60ef9439793c9afe49761ee6
-
SSDEEP
196608:K9j+W0x7IFcfMq7U4D6VR2hX0b3h/QQn:K9D0x1Mq7Us6VR2hX0NYQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1096 TSTheme.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 920 0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe 920 0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe 1096 TSTheme.exe 1096 TSTheme.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 872 schtasks.exe 1544 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 920 0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe 1096 TSTheme.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 920 wrote to memory of 872 920 0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe 27 PID 920 wrote to memory of 872 920 0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe 27 PID 920 wrote to memory of 872 920 0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe 27 PID 920 wrote to memory of 872 920 0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe 27 PID 920 wrote to memory of 2040 920 0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe 29 PID 920 wrote to memory of 2040 920 0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe 29 PID 920 wrote to memory of 2040 920 0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe 29 PID 920 wrote to memory of 2040 920 0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe 29 PID 1424 wrote to memory of 1096 1424 taskeng.exe 32 PID 1424 wrote to memory of 1096 1424 taskeng.exe 32 PID 1424 wrote to memory of 1096 1424 taskeng.exe 32 PID 1424 wrote to memory of 1096 1424 taskeng.exe 32 PID 1096 wrote to memory of 1544 1096 TSTheme.exe 33 PID 1096 wrote to memory of 1544 1096 TSTheme.exe 33 PID 1096 wrote to memory of 1544 1096 TSTheme.exe 33 PID 1096 wrote to memory of 1544 1096 TSTheme.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe"C:\Users\Admin\AppData\Local\Temp\0b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 5 /tn "TSTheme Server Module{Q4F5H2C4V3-J6F4M7O4-A3E4F2Q1}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TSTheme\TSTheme.exe"2⤵
- Creates scheduled task(s)
PID:872
-
-
C:\Windows\SysWOW64\schtasks.exe/C /Query /XML /TN "TSTheme Server Module{Q4F5H2C4V3-J6F4M7O4-A3E4F2Q1}"2⤵PID:2040
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {BE1DD9B1-FA80-419C-BB94-C441EC2B7589} S-1-5-21-1563773381-2037468142-1146002597-1000:YBHADZIG\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TSTheme\TSTheme.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\TSTheme\TSTheme.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 5 /tn "TSTheme Server Module{Q4F5H2C4V3-J6F4M7O4-A3E4F2Q1}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TSTheme\TSTheme.exe"3⤵
- Creates scheduled task(s)
PID:1544
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.0MB
MD588e6deee81ba6c70e517b7b4dcf56b5e
SHA1ba7c697fe8cab422e273115383a607dcdaf40079
SHA2560b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3
SHA5123dca60a81d2871e2005fe0413b04d1ea60a88ed75e149a57628dad2693248797e2e1dece4b680855bd739e95168bc091be39673d60ef9439793c9afe49761ee6
-
Filesize
6.0MB
MD588e6deee81ba6c70e517b7b4dcf56b5e
SHA1ba7c697fe8cab422e273115383a607dcdaf40079
SHA2560b676a206b26be5c6aa5caa6beea20c14889f15cdc58d8c39c520807382a86d3
SHA5123dca60a81d2871e2005fe0413b04d1ea60a88ed75e149a57628dad2693248797e2e1dece4b680855bd739e95168bc091be39673d60ef9439793c9afe49761ee6