Analysis
-
max time kernel
154s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2023 17:59
Behavioral task
behavioral1
Sample
runtime.exe
Resource
win10v2004-20230621-en
General
-
Target
runtime.exe
-
Size
227.2MB
-
MD5
7d7fc05dffdd1920250b8f2aa4af3959
-
SHA1
0ae64733075203122be0baedd4eefca22fc1402a
-
SHA256
3ff2423d73a03b7113872e7154373fb346a826a7bd1f4cd7577e15764ce47ff8
-
SHA512
73daec7a287fa7119fe44cf71b3780c4c51159f5562a80e6e6da73206954cf76af513c85cd7684eb003141bacb7c1449366d7023fa6d4f37631dc53b6eaae68c
-
SSDEEP
49152:pyWMOEmrU4VWLP6zev05oej0EL9gCegK/efy5d8A45EG273LCV0UOQJUh9q101GF:Eq6PQn4/9GEp32VLV+h9sF
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
runtime.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runtime_1 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\config\\runtime.exe" runtime.exe Set value (str) \REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runtime_2 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\config\\runtime.exe" runtime.exe Set value (str) \REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runtime_3 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\config\\runtime.exe" runtime.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1664 schtasks.exe 2400 schtasks.exe 2444 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 4168 powershell.exe 4168 powershell.exe 4748 powershell.exe 4748 powershell.exe 4556 powershell.exe 4556 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4168 powershell.exe Token: SeDebugPrivilege 4748 powershell.exe Token: SeDebugPrivilege 4556 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
runtime.exepowershell.exepowershell.exepowershell.exedescription pid process target process PID 1476 wrote to memory of 4168 1476 runtime.exe powershell.exe PID 1476 wrote to memory of 4168 1476 runtime.exe powershell.exe PID 4168 wrote to memory of 1664 4168 powershell.exe schtasks.exe PID 4168 wrote to memory of 1664 4168 powershell.exe schtasks.exe PID 1476 wrote to memory of 4748 1476 runtime.exe powershell.exe PID 1476 wrote to memory of 4748 1476 runtime.exe powershell.exe PID 4748 wrote to memory of 2400 4748 powershell.exe schtasks.exe PID 4748 wrote to memory of 2400 4748 powershell.exe schtasks.exe PID 1476 wrote to memory of 4556 1476 runtime.exe powershell.exe PID 1476 wrote to memory of 4556 1476 runtime.exe powershell.exe PID 4556 wrote to memory of 2444 4556 powershell.exe schtasks.exe PID 4556 wrote to memory of 2444 4556 powershell.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\runtime.exe"C:\Users\Admin\AppData\Local\Temp\runtime.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN runtime_1 /TR C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN runtime_1 /TR C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN runtime_2 /TR C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN runtime_2 /TR C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN runtime_3 /TR C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN runtime_3 /TR C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD55caad758326454b5788ec35315c4c304
SHA13aef8dba8042662a7fcf97e51047dc636b4d4724
SHA25683e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA5124e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exeFilesize
1998.7MB
MD59b4e820feac5d0e71a70900d0a57fc51
SHA1aa52227d9fe9802c9faf6b645884c4e67104253f
SHA25603d36a6fc6292581262cbd4fea10283d9152373cd7b30fdf262031da2f6fa5de
SHA512c961f1e5800b9ce657939589265db5aea1f81484f3cc2168738b7a80dbb1a5adbf15d2c76953c08fdf28a1c27064ec96fc4af2466e67cd9944f2c193584a0a7c
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i2b4mmzl.chy.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/4168-141-0x000001BFB6750000-0x000001BFB6772000-memory.dmpFilesize
136KB
-
memory/4168-146-0x000001BF9D880000-0x000001BF9D890000-memory.dmpFilesize
64KB
-
memory/4168-147-0x000001BF9D880000-0x000001BF9D890000-memory.dmpFilesize
64KB
-
memory/4168-148-0x000001BF9D880000-0x000001BF9D890000-memory.dmpFilesize
64KB
-
memory/4556-177-0x00000233A81E0000-0x00000233A81F0000-memory.dmpFilesize
64KB
-
memory/4556-178-0x00000233A81E0000-0x00000233A81F0000-memory.dmpFilesize
64KB