cb290c220f3e548dcbb6da1833165d4fc1a5cac6ab2f3636d1f25baaf4dd2079

General

Target

RFQ # 1045981 - MAA_D Plant Project r01.exe
Size

875KB
MD5

ac256a867183ec9f1a370bc41b58015d
SHA1

aaf4813c5870ff0882a4453904f8533db69bea75
SHA256

13c73dff53867a75126ec548cad96b47a82f412dfc347b7b68c97fbbdb33d818
SHA512

b09f63e657ca5ed04724cfe36e83cc62952e3dbdeb929f9e4ac3e9167573fa569a561a0cd2c3575c2f77349ea793c808acbd61f941bf7e6e8dd512f0f46cb760
SSDEEP

24576:B1gG1tCueiqrBvclUBhDrznW8OAqZDag49G6D3f8+8/Wi0:vgqtCDiqrhhznHWZODI6D3U+bi0

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1216 set thread context of 676	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	32
PID 676 set thread context of 1216	676	RegSvcs.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1148	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1216	RFQ # 1045981 - MAA_D Plant Project r01.exe
1216	RFQ # 1045981 - MAA_D Plant Project r01.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
1260	powershell.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe
676	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
676	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe
Token: SeDebugPrivilege	676	RegSvcs.exe
Token: SeDebugPrivilege	1260	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1260	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	28
PID 1216 wrote to memory of 1260	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	28
PID 1216 wrote to memory of 1260	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	28
PID 1216 wrote to memory of 1260	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	28
PID 1216 wrote to memory of 1148	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	30
PID 1216 wrote to memory of 1148	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	30
PID 1216 wrote to memory of 1148	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	30
PID 1216 wrote to memory of 1148	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	30
PID 1216 wrote to memory of 676	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	32
PID 1216 wrote to memory of 676	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	32
PID 1216 wrote to memory of 676	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	32
PID 1216 wrote to memory of 676	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	32
PID 1216 wrote to memory of 676	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	32
PID 1216 wrote to memory of 676	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	32
PID 1216 wrote to memory of 676	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	32
PID 1216 wrote to memory of 676	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	32
PID 1216 wrote to memory of 676	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	32
PID 1216 wrote to memory of 676	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	32
PID 1216 wrote to memory of 1004	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	33
PID 1216 wrote to memory of 1004	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	33
PID 1216 wrote to memory of 1004	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	33
PID 1216 wrote to memory of 1004	1216	RFQ # 1045981 - MAA_D Plant Project r01.exe	33

C:\Users\Admin\AppData\Local\Temp\RFQ # 1045981 - MAA_D Plant Project r01.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ # 1045981 - MAA_D Plant Project r01.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qWqppDN.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qWqppDN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB349.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1148
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:676
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  PID:1004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB349.tmp

Filesize
1KB

MD5
f36a1a1c86eb352273284a55dc0ade9a

SHA1
2f7ad5a735ed2fae2d8439fabec12edd31d2f729

SHA256
d1d521b148fd6df27176f401a12f8378da40ea9035cd6838c00405c77c0ceb03

SHA512
d15bc6940312d8295f464e2e0017e6424543f6c6f287aaaa91bd10bbd5b69ab969feb54b0aea9dfebccac4de0c77c9a528be53d4e6edb89b1afc8fcdba381c98

Download Submit
memory/676-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/676-77-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/676-76-0x00000000008F0000-0x0000000000BF3000-memory.dmp

Filesize
3.0MB

Download
memory/676-73-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/676-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/676-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/676-69-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1216-58-0x00000000008F0000-0x00000000008FC000-memory.dmp

Filesize
48KB

Download
memory/1216-65-0x0000000005040000-0x0000000005078000-memory.dmp

Filesize
224KB

Download
memory/1216-59-0x0000000004940000-0x00000000049B0000-memory.dmp

Filesize
448KB

Download
memory/1216-54-0x00000000009D0000-0x0000000000AB0000-memory.dmp

Filesize
896KB

Download
memory/1216-57-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

Filesize
256KB

Download
memory/1216-75-0x0000000007FD0000-0x00000000080EB000-memory.dmp

Filesize
1.1MB

Download
memory/1216-56-0x00000000005D0000-0x00000000005EA000-memory.dmp

Filesize
104KB

Download
memory/1216-55-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

Filesize
256KB

Download
memory/1260-72-0x00000000004D0000-0x0000000000510000-memory.dmp

Filesize
256KB

Download
memory/1260-74-0x00000000004D0000-0x0000000000510000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads