cefa523cb435720c81c933c07f02f2c3f09979228b8d6a43309724892f335ee0

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO350.exe
Size

994KB
MD5

8ba1b9dc62b3e8a9f8497a3d9e7eb015
SHA1

5b50af2c3a45c6a91836bd4010cc3ea561d90114
SHA256

5ad0bc2bae216bee7b9516d71f673ae773f7467eac446b0f44d963d5af5d574e
SHA512

6e00cda3a3e10105e525e0fe8dd9764cba72c4ce3ac393b61d499706db854d65967cd628970b4f38db6b93086dd62ed3e4869efc900151b2ccf2d0e4a886b375
SSDEEP

24576:lTfX1FUHIzmPkc/kvP3g6TP5ZOyYg3Cnp6B1c:lT/jUozKkUkvvHL3upOc

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2656	powershell.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe
2072	PO350.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	PO350.exe
Token: SeDebugPrivilege	2656	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2656	2072	PO350.exe	30
PID 2072 wrote to memory of 2656	2072	PO350.exe	30
PID 2072 wrote to memory of 2656	2072	PO350.exe	30
PID 2072 wrote to memory of 2656	2072	PO350.exe	30
PID 2072 wrote to memory of 2648	2072	PO350.exe	32
PID 2072 wrote to memory of 2648	2072	PO350.exe	32
PID 2072 wrote to memory of 2648	2072	PO350.exe	32
PID 2072 wrote to memory of 2648	2072	PO350.exe	32
PID 2072 wrote to memory of 2816	2072	PO350.exe	34
PID 2072 wrote to memory of 2816	2072	PO350.exe	34
PID 2072 wrote to memory of 2816	2072	PO350.exe	34
PID 2072 wrote to memory of 2816	2072	PO350.exe	34
PID 2072 wrote to memory of 2816	2072	PO350.exe	34
PID 2072 wrote to memory of 2816	2072	PO350.exe	34

C:\Users\Admin\AppData\Local\Temp\PO350.exe
"C:\Users\Admin\AppData\Local\Temp\PO350.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TRNAhcmuJQEKe.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TRNAhcmuJQEKe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp11EB.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2648
- C:\Users\Admin\AppData\Local\Temp\PO350.exe
  "C:\Users\Admin\AppData\Local\Temp\PO350.exe"
  2⤵
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp11EB.tmp

Filesize
1KB

MD5
3cee9d885cef5f63e338fbe433ff72a6

SHA1
9dcf71da16d1e50908243623bdf2aed5b876e7b3

SHA256
f27a3f97037858bd15bf54c55dcef1d17c66669a7b4b20bbaf23e3913e84eab8

SHA512
6bd4c3fde46cc86ab6d6e8636f201897861aee98687c3fbdfb79575d81289e6526a3abd2634ce1cf60f4c38a0b5ff0c8394886232e86237480048129b9164513

Download Submit
memory/2072-4-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/2072-3-0x00000000003C0000-0x00000000003D8000-memory.dmp

Filesize
96KB

Download
memory/2072-1-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/2072-0-0x0000000001000000-0x00000000010FE000-memory.dmp

Filesize
1016KB

Download
memory/2072-6-0x00000000003A0000-0x00000000003AA000-memory.dmp

Filesize
40KB

Download
memory/2072-2-0x0000000000F30000-0x0000000000F70000-memory.dmp

Filesize
256KB

Download
memory/2072-7-0x000000000A4E0000-0x000000000A598000-memory.dmp

Filesize
736KB

Download
memory/2072-5-0x0000000000F30000-0x0000000000F70000-memory.dmp

Filesize
256KB

Download
memory/2656-21-0x00000000025A0000-0x00000000025E0000-memory.dmp

Filesize
256KB

Download
memory/2656-23-0x000000006EC50000-0x000000006F1FB000-memory.dmp

Filesize
5.7MB

Download
memory/2656-22-0x00000000025A0000-0x00000000025E0000-memory.dmp

Filesize
256KB

Download
memory/2656-19-0x000000006EC50000-0x000000006F1FB000-memory.dmp

Filesize
5.7MB

Download
memory/2656-20-0x000000006EC50000-0x000000006F1FB000-memory.dmp

Filesize
5.7MB

Download
memory/2816-15-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2816-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2816-17-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download