Analysis
- max time kernel
151s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
24/07/2023, 07:16
General
- Target FitsPO.exe
- Size 940KB
- Sample230724-h3yscabb38
- SHA256 df2604898f1cf4e99ef89473d177bc42464a6196fadfb94a3d173dc0006580e0
Malware Config
Signatures
- Drops file in System32 directory 3 IoCs
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FitsPO.exe"C:\Users\Admin\AppData\Local\Temp\FitsPO.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 13522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 216 -ip 2161⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
wsuAE70.tmp
9NCBCSZSJRSB.dat
9NCBCSZSJRSB.dat
9NCBCSZSJRSB.dat
9NCBCSZSJRSB.dat
9NCBCSZSJRSB.dat
9NCBCSZSJRSB.dat
9NCBCSZSJRSB.dat
9NCBCSZSJRSB.dat
9NCBCSZSJRSB.dat
memory/216-139-0x0000000004B20000-0x0000000004B2A000-memory.dmp
memory/216-136-0x00000000051B0000-0x0000000005754000-memory.dmp
memory/216-141-0x0000000004FE0000-0x0000000004FFE000-memory.dmp
memory/216-140-0x0000000004E20000-0x0000000004E76000-memory.dmp
memory/216-133-0x0000000000030000-0x0000000000122000-memory.dmp
memory/216-138-0x0000000004A90000-0x0000000004AA0000-memory.dmp
memory/216-137-0x0000000004C00000-0x0000000004C92000-memory.dmp
memory/216-143-0x0000000074400000-0x0000000074BB0000-memory.dmp
memory/216-134-0x0000000074400000-0x0000000074BB0000-memory.dmp
memory/216-135-0x0000000004B60000-0x0000000004BFC000-memory.dmp
memory/4568-493-0x0000029551930000-0x0000029551931000-memory.dmp
memory/4568-495-0x0000029551960000-0x0000029551961000-memory.dmp
memory/4568-496-0x0000029551960000-0x0000029551961000-memory.dmp
memory/4568-497-0x0000029551A70000-0x0000029551A71000-memory.dmp
memory/4568-477-0x0000029549640000-0x0000029549650000-memory.dmp
memory/4568-458-0x0000029549540000-0x0000029549550000-memory.dmp