f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e

General

Target

f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe
Size

759KB
MD5

165b4e943d83e5bf3beda044089131c3
SHA1

1e00cd2baa1d26db9a265346b0aa7796f377ae9b
SHA256

f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e
SHA512

40edc7d69efa6638e00944f653bdf3948ddc049968c7a60379c3b8ce659ed4167dbc1c1382ff2a33e94c81341c4dc4902d92a08f1edf31bf9e373ab7e6208c61
SSDEEP

12288:VhYiIoFwIrG3XCCa4ZSJ8kjNz/PDWzGLrP5tfB7YC3c3JCzclt4i:LHIcTrGCYsJ8kxjPDF5ZB7rcCk

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1360 set thread context of 2724	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe
1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe
1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe
1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe
1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe
1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe
1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe
1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe
1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe
3012	powershell.exe
2688	powershell.exe
2724	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 3012	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	30
PID 1360 wrote to memory of 3012	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	30
PID 1360 wrote to memory of 3012	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	30
PID 1360 wrote to memory of 3012	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	30
PID 1360 wrote to memory of 2688	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	32
PID 1360 wrote to memory of 2688	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	32
PID 1360 wrote to memory of 2688	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	32
PID 1360 wrote to memory of 2688	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	32
PID 1360 wrote to memory of 2868	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	33
PID 1360 wrote to memory of 2868	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	33
PID 1360 wrote to memory of 2868	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	33
PID 1360 wrote to memory of 2868	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	33
PID 1360 wrote to memory of 2724	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	36
PID 1360 wrote to memory of 2724	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	36
PID 1360 wrote to memory of 2724	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	36
PID 1360 wrote to memory of 2724	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	36
PID 1360 wrote to memory of 2724	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	36
PID 1360 wrote to memory of 2724	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	36
PID 1360 wrote to memory of 2724	1360	f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe	36

C:\Users\Admin\AppData\Local\Temp\f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe
"C:\Users\Admin\AppData\Local\Temp\f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NYXzInoCJoGksy.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NYXzInoCJoGksy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3488.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2868
- C:\Users\Admin\AppData\Local\Temp\f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe
  "C:\Users\Admin\AppData\Local\Temp\f45f66c4650d2b30132ec07228a13ab97964021039747ae083cdd61f397ee05e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3488.tmp

Filesize
1KB

MD5
91d4286b2efec471b7a40849da90c07a

SHA1
a153bfc9b68417c4783bfb2e637cf0c603b4c52c

SHA256
cf2f24ed84f2ccdbb124fa5203519db0675d3fcefb0acf78c71375044c327350

SHA512
8dee6ce08da2934ae86b8ecd000fd88cbe606689f7fd4a688a1de8ca0bb54873b38704152ca250322e34fe842764143687e379ee1e513181f6167d99bb94c647

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WVGZ9INI13R4GQKSOY8P.temp

Filesize
7KB

MD5
8f5214dea6fafad1f5cea0a76a73691b

SHA1
bfb34a86376246c42f05ecd158ad0a7c5f6c50d4

SHA256
2e5a53412dd558e6aaa56c6f56edcf55b7599991955b17f2d3eba39d615929ab

SHA512
44cef3fe4c799f450ef7fdb59ae0d400477d908c3c50ff4545c4e5703d9e828d7c4774e25d7bfd9c1510263ba0b67c488bf921a0ee0d4aeae32998b0ed2e4ceb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
8f5214dea6fafad1f5cea0a76a73691b

SHA1
bfb34a86376246c42f05ecd158ad0a7c5f6c50d4

SHA256
2e5a53412dd558e6aaa56c6f56edcf55b7599991955b17f2d3eba39d615929ab

SHA512
44cef3fe4c799f450ef7fdb59ae0d400477d908c3c50ff4545c4e5703d9e828d7c4774e25d7bfd9c1510263ba0b67c488bf921a0ee0d4aeae32998b0ed2e4ceb

Download Submit
memory/1360-61-0x0000000004F60000-0x0000000004FD6000-memory.dmp

Filesize
472KB

Download
memory/1360-55-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

Filesize
256KB

Download
memory/1360-58-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

Filesize
256KB

Download
memory/1360-59-0x0000000000590000-0x0000000000598000-memory.dmp

Filesize
32KB

Download
memory/1360-60-0x0000000000740000-0x000000000074A000-memory.dmp

Filesize
40KB

Download
memory/1360-81-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/1360-56-0x0000000000530000-0x0000000000542000-memory.dmp

Filesize
72KB

Download
memory/1360-57-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/1360-54-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/1360-53-0x00000000010B0000-0x0000000001174000-memory.dmp

Filesize
784KB

Download
memory/2688-89-0x0000000002670000-0x00000000026B0000-memory.dmp

Filesize
256KB

Download
memory/2688-92-0x000000006F830000-0x000000006FDDB000-memory.dmp

Filesize
5.7MB

Download
memory/2688-85-0x000000006F830000-0x000000006FDDB000-memory.dmp

Filesize
5.7MB

Download
memory/2688-82-0x000000006F830000-0x000000006FDDB000-memory.dmp

Filesize
5.7MB

Download
memory/2724-78-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2724-80-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2724-86-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2724-76-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2724-90-0x0000000000880000-0x0000000000B83000-memory.dmp

Filesize
3.0MB

Download
memory/2724-74-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3012-83-0x000000006F830000-0x000000006FDDB000-memory.dmp

Filesize
5.7MB

Download
memory/3012-84-0x0000000000290000-0x00000000002D0000-memory.dmp

Filesize
256KB

Download
memory/3012-87-0x0000000000290000-0x00000000002D0000-memory.dmp

Filesize
256KB

Download
memory/3012-88-0x0000000000290000-0x00000000002D0000-memory.dmp

Filesize
256KB

Download
memory/3012-91-0x000000006F830000-0x000000006FDDB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads