Analysis
-
max time kernel
62s -
max time network
29s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
09-06-2023 07:12
Static task
static1
Behavioral task
behavioral1
Sample
06211199.exe
Resource
win7-20230220-en
General
-
Target
06211199.exe
-
Size
787KB
-
MD5
0e6861c721b9342f69eba894703f6484
-
SHA1
6c9b0712a4c249805f2f2f1760cd72cf917aa7c6
-
SHA256
fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44
-
SHA512
6beb131306e2ae3b91d62f3630271b6755957f2046870ae4b62313851e98b4a2837053ea86d06da3f91d6b9b8ab81eb7e8bf7ccc26b1cb3cbe6cdf9e7db0dbe8
-
SSDEEP
6144:de/RS6Ugha13DnnTawr+BpIW85aDIamyJ95xuuEHQiljH6gnGJZ1ZnImK:deZB1hXwr+h85pMbxuuEHNe6IZBK
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
06211199.exepid process 1336 06211199.exe 1336 06211199.exe 1336 06211199.exe 1336 06211199.exe 1336 06211199.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
06211199.exedescription pid process Token: SeDebugPrivilege 1336 06211199.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
06211199.exedescription pid process target process PID 1336 wrote to memory of 268 1336 06211199.exe schtasks.exe PID 1336 wrote to memory of 268 1336 06211199.exe schtasks.exe PID 1336 wrote to memory of 268 1336 06211199.exe schtasks.exe PID 1336 wrote to memory of 268 1336 06211199.exe schtasks.exe PID 1336 wrote to memory of 1732 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 1732 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 1732 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 1732 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 1704 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 1704 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 1704 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 1704 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 1764 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 1764 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 1764 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 1764 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 816 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 816 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 816 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 816 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 880 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 880 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 880 1336 06211199.exe 06211199.exe PID 1336 wrote to memory of 880 1336 06211199.exe 06211199.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06211199.exe"C:\Users\Admin\AppData\Local\Temp\06211199.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ziFpddctAZBdQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp44AF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\06211199.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\06211199.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\06211199.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\06211199.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\06211199.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp44AF.tmpFilesize
1KB
MD5033dc4ed905e460381a581cc7860666f
SHA1d576d792213a03c6bbf24d0d03e4889bb274f90a
SHA256d99a1705c4fe80b71b580f2bedd163241c360f2015c8bf92ade4607661fe4acc
SHA512a4ce151648d3cceef09d52c5db1bb5ed2e62d23ac3af47ce0baf63aa1897fef812515a42987cc0d14ebe750e2589446a3f59fc499df7fb77b04ff2f473217aa0
-
memory/1336-54-0x00000000003E0000-0x00000000004AC000-memory.dmpFilesize
816KB
-
memory/1336-55-0x0000000004DD0000-0x0000000004E10000-memory.dmpFilesize
256KB
-
memory/1336-56-0x0000000004DD0000-0x0000000004E10000-memory.dmpFilesize
256KB
-
memory/1336-57-0x00000000004B0000-0x00000000004C4000-memory.dmpFilesize
80KB
-
memory/1336-58-0x0000000004D10000-0x0000000004D76000-memory.dmpFilesize
408KB
-
memory/1336-59-0x0000000000540000-0x0000000000552000-memory.dmpFilesize
72KB