d88edf845c4129c4b77cd0900f54bdb5fd24354702e9fd3249ed3c94f484ebb5

General

Target

4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe
Size

871KB
MD5

227eec77c6eda60a64c4e5b51d5e51f6
SHA1

5eaeb77a0e804c062a314cb8c70abaa5d16feba3
SHA256

4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d
SHA512

cb0a83611281291cddb10eec56140d5aad4be900953057bf8c4580f256085b2ced9d990ab309cfda40d661831b810013df027ca1857ceafff2cd588eec1dbfd8
SSDEEP

24576:BgG1tCueii9iiBjUQE5JzXehReI5Pgbng:BgqtCDiNiBAHiReSPgk

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 912 set thread context of 884	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe
912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe
912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe
912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
1672	powershell.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe
884	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe
Token: SeDebugPrivilege	884	RegSvcs.exe
Token: SeDebugPrivilege	1672	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1672	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	28
PID 912 wrote to memory of 1672	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	28
PID 912 wrote to memory of 1672	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	28
PID 912 wrote to memory of 1672	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	28
PID 912 wrote to memory of 1088	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	30
PID 912 wrote to memory of 1088	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	30
PID 912 wrote to memory of 1088	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	30
PID 912 wrote to memory of 1088	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	30
PID 912 wrote to memory of 1592	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	32
PID 912 wrote to memory of 1592	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	32
PID 912 wrote to memory of 1592	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	32
PID 912 wrote to memory of 1592	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	32
PID 912 wrote to memory of 1592	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	32
PID 912 wrote to memory of 1592	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	32
PID 912 wrote to memory of 1592	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	32
PID 912 wrote to memory of 884	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	33
PID 912 wrote to memory of 884	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	33
PID 912 wrote to memory of 884	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	33
PID 912 wrote to memory of 884	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	33
PID 912 wrote to memory of 884	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	33
PID 912 wrote to memory of 884	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	33
PID 912 wrote to memory of 884	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	33
PID 912 wrote to memory of 884	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	33
PID 912 wrote to memory of 884	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	33
PID 912 wrote to memory of 884	912	4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe	33

C:\Users\Admin\AppData\Local\Temp\4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe
"C:\Users\Admin\AppData\Local\Temp\4e8d1df344f5009ab35ebb5fed59649cce3e0a9b7f27f312a7cc854eb74b889d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\EiiSSvUctTst.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EiiSSvUctTst" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9B37.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9B37.tmp

Filesize
1KB

MD5
2b363dd9cd45bbf88e104753e6ca63dc

SHA1
cd6ea34684d66161d227a6f9f99c055d3a36fb79

SHA256
8aeca230d9fdbdf58f04f4fbfeea33ac0b2987fb779af468a25d13356b7f746d

SHA512
d990b208cfee794855fc04fc44289d120131f1b33ff5ac38840a71397bda70aafb5ac93bb7ed89c9689166fa5d6dece15dd6d2aa61271ecf7233e1c1b53ed0d9

Download Submit
memory/884-69-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/884-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/884-73-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/884-72-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Filesize
3.0MB

Download
memory/884-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/884-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/912-65-0x00000000051A0000-0x00000000051D8000-memory.dmp

Filesize
224KB

Download
memory/912-55-0x00000000043C0000-0x0000000004400000-memory.dmp

Filesize
256KB

Download
memory/912-54-0x0000000000CA0000-0x0000000000D80000-memory.dmp

Filesize
896KB

Download
memory/912-59-0x0000000004980000-0x00000000049F0000-memory.dmp

Filesize
448KB

Download
memory/912-56-0x0000000002180000-0x000000000219A000-memory.dmp

Filesize
104KB

Download
memory/912-58-0x0000000000350000-0x000000000035C000-memory.dmp

Filesize
48KB

Download
memory/912-57-0x00000000043C0000-0x0000000004400000-memory.dmp

Filesize
256KB

Download
memory/1672-74-0x0000000002740000-0x0000000002780000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads