Analysis
-
max time kernel
47s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
17-06-2023 02:56
Static task
static1
Behavioral task
behavioral1
Sample
build3.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
build3.exe
Resource
win10v2004-20230220-en
General
-
Target
build3.exe
-
Size
9KB
-
MD5
9ead10c08e72ae41921191f8db39bc16
-
SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1
-
SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
-
SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
SSDEEP
192:9UEc8b6H1LE+4LoGgMatAJ2lzUw317NyEpvNHhqyo:9UUE1BYoGza/D3170kiyo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
mstsca.exepid process 1872 mstsca.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
build3.exetaskeng.exemstsca.exedescription pid process target process PID 1704 wrote to memory of 2044 1704 build3.exe schtasks.exe PID 1704 wrote to memory of 2044 1704 build3.exe schtasks.exe PID 1704 wrote to memory of 2044 1704 build3.exe schtasks.exe PID 1704 wrote to memory of 2044 1704 build3.exe schtasks.exe PID 1236 wrote to memory of 1872 1236 taskeng.exe mstsca.exe PID 1236 wrote to memory of 1872 1236 taskeng.exe mstsca.exe PID 1236 wrote to memory of 1872 1236 taskeng.exe mstsca.exe PID 1236 wrote to memory of 1872 1236 taskeng.exe mstsca.exe PID 1872 wrote to memory of 520 1872 mstsca.exe schtasks.exe PID 1872 wrote to memory of 520 1872 mstsca.exe schtasks.exe PID 1872 wrote to memory of 520 1872 mstsca.exe schtasks.exe PID 1872 wrote to memory of 520 1872 mstsca.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\build3.exe"C:\Users\Admin\AppData\Local\Temp\build3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {97DBE534-75D3-4251-9FC8-B57407282D04} S-1-5-21-3948302646-268491222-1934009652-1000:KXZDHPUW\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a