f99346e6bfab74ed0e6d10f5d906a205d3e16fd86de1a3cdaffe69791a7bf439

General

Target

8799e2f7a7b481822d32cdaba4151bd0_exe32.exe
Size

92KB
MD5

8799e2f7a7b481822d32cdaba4151bd0
SHA1

5542dfb0d19b05041832380555ccb3de6f601893
SHA256

f99346e6bfab74ed0e6d10f5d906a205d3e16fd86de1a3cdaffe69791a7bf439
SHA512

78df439f628e0e37c5da70d5961c57bc9fdb6d3774b0f6e1436c6cfb18a9b05740d8dda5a8676ab46ed6a149bfb680a4389b4d533bc8ccaf6d66621a1c673add
SSDEEP

1536:qUD7lbMshaamkAwBgttX6hx0p2Kc3/CJD6rKcDiaSNPL3JPBx+XD+vjRISg:qUD7vbmlwBgttXux+2zq56rKX15B3g

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2364	tasksrvc.exe

Loads dropped DLL 2 IoCs

pid	Process
2548	8799e2f7a7b481822d32cdaba4151bd0_exe32.exe
2548	8799e2f7a7b481822d32cdaba4151bd0_exe32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\tasksrvc.exe = "c:\\users\\admin\\appdata\\local\\temp\\tasksrvc.exe"	8799e2f7a7b481822d32cdaba4151bd0_exe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tasksrvc.exe = "c:\\users\\admin\\appdata\\local\\temp\\tasksrvc.exe"	8799e2f7a7b481822d32cdaba4151bd0_exe32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2548	8799e2f7a7b481822d32cdaba4151bd0_exe32.exe
2364	tasksrvc.exe
2364	tasksrvc.exe
2364	tasksrvc.exe
2364	tasksrvc.exe
2364	tasksrvc.exe
2364	tasksrvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2364	2548	8799e2f7a7b481822d32cdaba4151bd0_exe32.exe	28
PID 2548 wrote to memory of 2364	2548	8799e2f7a7b481822d32cdaba4151bd0_exe32.exe	28
PID 2548 wrote to memory of 2364	2548	8799e2f7a7b481822d32cdaba4151bd0_exe32.exe	28
PID 2548 wrote to memory of 2364	2548	8799e2f7a7b481822d32cdaba4151bd0_exe32.exe	28

C:\Users\Admin\AppData\Local\Temp\8799e2f7a7b481822d32cdaba4151bd0_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\8799e2f7a7b481822d32cdaba4151bd0_exe32.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\appdata\local\temp\tasksrvc.exe
  "C:\Users\Admin\appdata\local\temp\tasksrvc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tasksrvc.exe

Filesize
92KB

MD5
8cc6cf6b4da6bb8144c2d8adc8a952ee

SHA1
f649b02c22f7e5571a2b18dfa2803b3f1c5b3038

SHA256
70e3eb574cd2927b6c56d523d838ffece0e793b5efe060f4f882bd00c0460c21

SHA512
722c9e7db9c8098eb80e9d050590e99a9b4eb054b8a537763e3748ff93654412aeb52537820767558c78e3deedcf0b3a483d47ac2f677d8bb53801b42546ee72

Download Submit
C:\Users\Admin\AppData\Local\Temp\tasksrvc.exe

Filesize
92KB

MD5
8cc6cf6b4da6bb8144c2d8adc8a952ee

SHA1
f649b02c22f7e5571a2b18dfa2803b3f1c5b3038

SHA256
70e3eb574cd2927b6c56d523d838ffece0e793b5efe060f4f882bd00c0460c21

SHA512
722c9e7db9c8098eb80e9d050590e99a9b4eb054b8a537763e3748ff93654412aeb52537820767558c78e3deedcf0b3a483d47ac2f677d8bb53801b42546ee72

Download Submit
C:\Users\Admin\appdata\local\temp\tasksrvc.exe

Filesize
92KB

MD5
8cc6cf6b4da6bb8144c2d8adc8a952ee

SHA1
f649b02c22f7e5571a2b18dfa2803b3f1c5b3038

SHA256
70e3eb574cd2927b6c56d523d838ffece0e793b5efe060f4f882bd00c0460c21

SHA512
722c9e7db9c8098eb80e9d050590e99a9b4eb054b8a537763e3748ff93654412aeb52537820767558c78e3deedcf0b3a483d47ac2f677d8bb53801b42546ee72

Download Submit
\Users\Admin\AppData\Local\Temp\tasksrvc.exe

Filesize
92KB

MD5
8cc6cf6b4da6bb8144c2d8adc8a952ee

SHA1
f649b02c22f7e5571a2b18dfa2803b3f1c5b3038

SHA256
70e3eb574cd2927b6c56d523d838ffece0e793b5efe060f4f882bd00c0460c21

SHA512
722c9e7db9c8098eb80e9d050590e99a9b4eb054b8a537763e3748ff93654412aeb52537820767558c78e3deedcf0b3a483d47ac2f677d8bb53801b42546ee72

Download Submit
\Users\Admin\AppData\Local\Temp\tasksrvc.exe

Filesize
92KB

MD5
8cc6cf6b4da6bb8144c2d8adc8a952ee

SHA1
f649b02c22f7e5571a2b18dfa2803b3f1c5b3038

SHA256
70e3eb574cd2927b6c56d523d838ffece0e793b5efe060f4f882bd00c0460c21

SHA512
722c9e7db9c8098eb80e9d050590e99a9b4eb054b8a537763e3748ff93654412aeb52537820767558c78e3deedcf0b3a483d47ac2f677d8bb53801b42546ee72

Download Submit
memory/2364-13-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2364-15-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2548-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2548-12-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads