fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7

General

Target

fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe
Size

1.2MB
MD5

b3e175814b1dbe92e2290e63e246326a
SHA1

7dc23762ffea3f37c5b0ff6bf2afdb656a061cea
SHA256

fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7
SHA512

960f1c72b1771a54082ff235a1af5a7efad829bb89df23d93cabbaa26c2bed9b531ad076c3f26b74c88d16fff4c46653ae4a8c49737f2279f397487ca94df719
SSDEEP

24576:74hM2lujsqx43AtWdbrFX11RcL7KHaVlTZTlPvhJG9QLmm0Hd:bcpAtWVJq5HeQLm

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4176 set thread context of 4556	4176	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	72
PID 4556 set thread context of 3856	4556	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	75

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
344	schtasks.exe
4532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4176	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe
4556	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4176	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe
Token: SeDebugPrivilege	4556	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 344	4176	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	70
PID 4176 wrote to memory of 344	4176	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	70
PID 4176 wrote to memory of 344	4176	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	70
PID 4176 wrote to memory of 4556	4176	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	72
PID 4176 wrote to memory of 4556	4176	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	72
PID 4176 wrote to memory of 4556	4176	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	72
PID 4176 wrote to memory of 4556	4176	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	72
PID 4176 wrote to memory of 4556	4176	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	72
PID 4176 wrote to memory of 4556	4176	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	72
PID 4176 wrote to memory of 4556	4176	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	72
PID 4176 wrote to memory of 4556	4176	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	72
PID 4556 wrote to memory of 4532	4556	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	73
PID 4556 wrote to memory of 4532	4556	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	73
PID 4556 wrote to memory of 4532	4556	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	73
PID 4556 wrote to memory of 3856	4556	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	75
PID 4556 wrote to memory of 3856	4556	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	75
PID 4556 wrote to memory of 3856	4556	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	75
PID 4556 wrote to memory of 3856	4556	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	75
PID 4556 wrote to memory of 3856	4556	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	75
PID 4556 wrote to memory of 3856	4556	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	75
PID 4556 wrote to memory of 3856	4556	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	75
PID 4556 wrote to memory of 3856	4556	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	75
PID 4556 wrote to memory of 3856	4556	fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe	75

C:\Users\Admin\AppData\Local\Temp\fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe
"C:\Users\Admin\AppData\Local\Temp\fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eAtjzWybgHr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1EFD.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:344
- C:\Users\Admin\AppData\Local\Temp\fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe
  "{path}"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\axfqXlCIdnYAe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8CDA.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:4532
- - C:\Users\Admin\AppData\Local\Temp\fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe
    "{path}"
    3⤵
    PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fde0f1954aa3a1bf57a1c578d0f3330834c51a6fec0bc8455282c9c688bdd9f7.exe.log

Filesize
1KB

MD5
90acfd72f14a512712b1a7380c0faf60

SHA1
40ba4accb8faa75887e84fb8e38d598dc8cf0f12

SHA256
20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

SHA512
29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1EFD.tmp

Filesize
1KB

MD5
a6b119806eba49dff0ad37c6c5d8645d

SHA1
9a85870f7af6fb9178e0c907c8a2c44e7d0ba2ca

SHA256
24380726d9efc0cbe7aecf5e9817e076d075cbab13d4968297cff67992045b9a

SHA512
e063dc697e2b4879b913308489a2bc108eb1430b416972a40cacb48342b5614a02dcdce259f685799e07b94e78d44ea85349cf180f1e5bfb6e430807dc585aa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8CDA.tmp

Filesize
1KB

MD5
fbd0eb543180f974e4d2f37ad2cd12f5

SHA1
51747c326672f725d3cc8a3062e52c60c0f539a3

SHA256
5b6f1e78f838c11c796ac9448b29a3e93be19de263f7b9156b359f241f975364

SHA512
70f9550cab372a25f157496a19a9a4c76c1179eafe6abd2880abca912e27538497df1f640a393adc7a33e9927e49b44de8c02567a341dd5031f526ede85e5dee

Download Submit
memory/3856-34-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3856-35-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3856-36-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3856-37-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4176-5-0x00000000051A0000-0x00000000051B0000-memory.dmp

Filesize
64KB

Download
memory/4176-14-0x000000000B990000-0x000000000BA6A000-memory.dmp

Filesize
872KB

Download
memory/4176-9-0x0000000008C60000-0x0000000008C6C000-memory.dmp

Filesize
48KB

Download
memory/4176-10-0x0000000073110000-0x00000000737FE000-memory.dmp

Filesize
6.9MB

Download
memory/4176-11-0x00000000051A0000-0x00000000051B0000-memory.dmp

Filesize
64KB

Download
memory/4176-12-0x000000007F190000-0x000000007F1A0000-memory.dmp

Filesize
64KB

Download
memory/4176-13-0x00000000092D0000-0x00000000093E8000-memory.dmp

Filesize
1.1MB

Download
memory/4176-8-0x000000007F190000-0x000000007F1A0000-memory.dmp

Filesize
64KB

Download
memory/4176-7-0x0000000005210000-0x0000000005266000-memory.dmp

Filesize
344KB

Download
memory/4176-0-0x0000000000570000-0x00000000006A8000-memory.dmp

Filesize
1.2MB

Download
memory/4176-6-0x0000000004ED0000-0x0000000004EDA000-memory.dmp

Filesize
40KB

Download
memory/4176-21-0x0000000073110000-0x00000000737FE000-memory.dmp

Filesize
6.9MB

Download
memory/4176-4-0x0000000004FE0000-0x0000000005072000-memory.dmp

Filesize
584KB

Download
memory/4176-3-0x00000000054E0000-0x00000000059DE000-memory.dmp

Filesize
5.0MB

Download
memory/4176-2-0x0000000004F40000-0x0000000004FDC000-memory.dmp

Filesize
624KB

Download
memory/4176-1-0x0000000073110000-0x00000000737FE000-memory.dmp

Filesize
6.9MB

Download
memory/4556-18-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/4556-27-0x000000007E4E0000-0x000000007E4F0000-memory.dmp

Filesize
64KB

Download
memory/4556-28-0x00000000097E0000-0x00000000098A6000-memory.dmp

Filesize
792KB

Download
memory/4556-29-0x0000000009610000-0x000000000968E000-memory.dmp

Filesize
504KB

Download
memory/4556-26-0x0000000005AB0000-0x0000000005AC0000-memory.dmp

Filesize
64KB

Download
memory/4556-33-0x000000000F8B0000-0x000000000F929000-memory.dmp

Filesize
484KB

Download
memory/4556-25-0x0000000073110000-0x00000000737FE000-memory.dmp

Filesize
6.9MB

Download
memory/4556-24-0x000000007E4E0000-0x000000007E4F0000-memory.dmp

Filesize
64KB

Download
memory/4556-23-0x0000000005AB0000-0x0000000005AC0000-memory.dmp

Filesize
64KB

Download
memory/4556-22-0x0000000073110000-0x00000000737FE000-memory.dmp

Filesize
6.9MB

Download
memory/4556-38-0x0000000073110000-0x00000000737FE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads