0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8

Analysis

max time kernel
120s
max time network
143s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
Size

5.2MB
MD5

0e9cc5c2145bae2f6ab41f186dac87d1
SHA1

3a495afddc1ed60ecc5c403a6e9dcdc53516ca35
SHA256

0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8
SHA512

76d46c1d2a126447473d25dae41757a2acf82cb1b79412ae4b887c6f8006515977388f00b8ba5c6162bc8cd3177f465362267402229c82bcd7171509219caccb
SSDEEP

98304:w8ZEl7sMD+0Jz27AoQDu4oI87ozUUG77J6mzRLmvV7FLcVXaR:w4mgMD+0Jz2cDu4e6mzNmthL+C

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

Processes:

0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe

description	pid	process	target process
PID 1176 created 1276	1176	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe	Explorer.EXE
PID 1176 created 1276	1176	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe	Explorer.EXE
PID 1176 created 1276	1176	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe	Explorer.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2648 schtasks.exe

pid	process
2648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe

pid	process
1176	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
1176	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
1176	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
1176	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
1176	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
1176	0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1276
- C:\Users\Admin\AppData\Local\Temp\0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
  "C:\Users\Admin\AppData\Local\Temp\0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  PID:1176
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2612
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml"
  2⤵
  - Creates scheduled task(s)
  PID:2648
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
memory/1176-0-0x000000013F1E0000-0x000000013F711000-memory.dmp

Filesize
5.2MB

Download
memory/1176-3-0x000000013F1E0000-0x000000013F711000-memory.dmp

Filesize
5.2MB

Download
memory/1176-6-0x000000013F1E0000-0x000000013F711000-memory.dmp

Filesize
5.2MB

Download