47c4195b8dd140e14dc9284692685c07b4a54c9ca77fcef6d69c7cabd368af31

General

Target

NA_47c4195b8dd140e14dc928469_JC.exe
Size

847KB
MD5

947dbfc5ef8d4e97bf4c1ab1c38a77d7
SHA1

3c517a3fb8bc82a0dde90c4369925f5c4ab20a42
SHA256

47c4195b8dd140e14dc9284692685c07b4a54c9ca77fcef6d69c7cabd368af31
SHA512

f57d26e688005583dcdc803a5357a83995160321e131783f782b42fa02e7b551a17f46e36e7c4c32d619cd968c0d0e8982a3900afa7962a6967a6a28269cb99d
SSDEEP

12288:9CUn9z+0cA7sWgXc7JI0kmvn9N++clQsjpLAy5W9WgJJWA8r1D0A:9Ce+01IWgs7iacrFLAyoRMfV0A

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 2364	2100	NA_47c4195b8dd140e14dc928469_JC.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2100	NA_47c4195b8dd140e14dc928469_JC.exe
2100	NA_47c4195b8dd140e14dc928469_JC.exe
2100	NA_47c4195b8dd140e14dc928469_JC.exe
2100	NA_47c4195b8dd140e14dc928469_JC.exe
2100	NA_47c4195b8dd140e14dc928469_JC.exe
2100	NA_47c4195b8dd140e14dc928469_JC.exe
2100	NA_47c4195b8dd140e14dc928469_JC.exe
2364	NA_47c4195b8dd140e14dc928469_JC.exe
2956	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	NA_47c4195b8dd140e14dc928469_JC.exe
Token: SeDebugPrivilege	2956	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2956	2100	NA_47c4195b8dd140e14dc928469_JC.exe	30
PID 2100 wrote to memory of 2956	2100	NA_47c4195b8dd140e14dc928469_JC.exe	30
PID 2100 wrote to memory of 2956	2100	NA_47c4195b8dd140e14dc928469_JC.exe	30
PID 2100 wrote to memory of 2956	2100	NA_47c4195b8dd140e14dc928469_JC.exe	30
PID 2100 wrote to memory of 2884	2100	NA_47c4195b8dd140e14dc928469_JC.exe	32
PID 2100 wrote to memory of 2884	2100	NA_47c4195b8dd140e14dc928469_JC.exe	32
PID 2100 wrote to memory of 2884	2100	NA_47c4195b8dd140e14dc928469_JC.exe	32
PID 2100 wrote to memory of 2884	2100	NA_47c4195b8dd140e14dc928469_JC.exe	32
PID 2100 wrote to memory of 2364	2100	NA_47c4195b8dd140e14dc928469_JC.exe	34
PID 2100 wrote to memory of 2364	2100	NA_47c4195b8dd140e14dc928469_JC.exe	34
PID 2100 wrote to memory of 2364	2100	NA_47c4195b8dd140e14dc928469_JC.exe	34
PID 2100 wrote to memory of 2364	2100	NA_47c4195b8dd140e14dc928469_JC.exe	34
PID 2100 wrote to memory of 2364	2100	NA_47c4195b8dd140e14dc928469_JC.exe	34
PID 2100 wrote to memory of 2364	2100	NA_47c4195b8dd140e14dc928469_JC.exe	34
PID 2100 wrote to memory of 2364	2100	NA_47c4195b8dd140e14dc928469_JC.exe	34

C:\Users\Admin\AppData\Local\Temp\NA_47c4195b8dd140e14dc928469_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NA_47c4195b8dd140e14dc928469_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bIdbySnEBTAaJ.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bIdbySnEBTAaJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2D96.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2884
- C:\Users\Admin\AppData\Local\Temp\NA_47c4195b8dd140e14dc928469_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NA_47c4195b8dd140e14dc928469_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2D96.tmp

Filesize
1KB

MD5
e816d7aa7d23d70df050e3a8c0c4c1ac

SHA1
4eaabb7f127c65e890d0aa6195f59ee7d06bff59

SHA256
c8c47e1e3f8215bfba4518c10abd43f7f5b7928dc0deb11de90dbcddd199ac39

SHA512
475bf96797900ebf938615290eab4c5d9dd2082e24af07e377c8cf5de1c46bb7ece6010e57307fafbe5a46e68965cd5bf70f14278d78661857f1d406f1eedcc4

Download Submit
memory/2100-55-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2100-54-0x0000000000E10000-0x0000000000EEA000-memory.dmp

Filesize
872KB

Download
memory/2100-56-0x0000000004B70000-0x0000000004BB0000-memory.dmp

Filesize
256KB

Download
memory/2100-57-0x00000000008B0000-0x00000000008C0000-memory.dmp

Filesize
64KB

Download
memory/2100-58-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2100-59-0x0000000004B70000-0x0000000004BB0000-memory.dmp

Filesize
256KB

Download
memory/2100-60-0x0000000000950000-0x000000000095A000-memory.dmp

Filesize
40KB

Download
memory/2100-61-0x0000000007E70000-0x0000000007EF6000-memory.dmp

Filesize
536KB

Download
memory/2100-76-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2364-71-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2364-73-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2364-75-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2364-69-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2364-78-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2364-80-0x0000000000A90000-0x0000000000D93000-memory.dmp

Filesize
3.0MB

Download
memory/2956-81-0x000000006E820000-0x000000006EDCB000-memory.dmp

Filesize
5.7MB

Download
memory/2956-79-0x0000000002740000-0x0000000002780000-memory.dmp

Filesize
256KB

Download
memory/2956-77-0x000000006E820000-0x000000006EDCB000-memory.dmp

Filesize
5.7MB

Download
memory/2956-82-0x0000000002740000-0x0000000002780000-memory.dmp

Filesize
256KB

Download
memory/2956-83-0x000000006E820000-0x000000006EDCB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads