7045c1465bc70e0f8a8eaac0515b457496c9641e7ce11fdbc1dab8e8ee08426e

General

Target

confirmation.exe
Size

835KB
MD5

9c7aef281dce8b4681588d60bdab153c
SHA1

a4ac0832c3dfda05c1196ad3edf753dcd26f7ac0
SHA256

7045c1465bc70e0f8a8eaac0515b457496c9641e7ce11fdbc1dab8e8ee08426e
SHA512

802357632270f4bd1beb223d70ed5b86bb5355b58fc3564c99d5a34e4ca3323e1202041ac038134e1a893321e3d7fd2c34cf4aa0ee64c39ca49c652813f54117
SSDEEP

12288:cuP2w40dOrytOTLRvORP3usgih7fk5pGiFiHQSM72YiGDP7r9r/+pppppppppppP:vF4ELttPmi7oFiwS1YdD1q

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2440	powershell.exe
2124	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2440	2376	confirmation.exe	28
PID 2376 wrote to memory of 2440	2376	confirmation.exe	28
PID 2376 wrote to memory of 2440	2376	confirmation.exe	28
PID 2376 wrote to memory of 2440	2376	confirmation.exe	28
PID 2376 wrote to memory of 2124	2376	confirmation.exe	30
PID 2376 wrote to memory of 2124	2376	confirmation.exe	30
PID 2376 wrote to memory of 2124	2376	confirmation.exe	30
PID 2376 wrote to memory of 2124	2376	confirmation.exe	30
PID 2376 wrote to memory of 2456	2376	confirmation.exe	32
PID 2376 wrote to memory of 2456	2376	confirmation.exe	32
PID 2376 wrote to memory of 2456	2376	confirmation.exe	32
PID 2376 wrote to memory of 2456	2376	confirmation.exe	32
PID 2376 wrote to memory of 2812	2376	confirmation.exe	34
PID 2376 wrote to memory of 2812	2376	confirmation.exe	34
PID 2376 wrote to memory of 2812	2376	confirmation.exe	34
PID 2376 wrote to memory of 2812	2376	confirmation.exe	34
PID 2376 wrote to memory of 2812	2376	confirmation.exe	34
PID 2376 wrote to memory of 2812	2376	confirmation.exe	34
PID 2376 wrote to memory of 2812	2376	confirmation.exe	34
PID 2376 wrote to memory of 2812	2376	confirmation.exe	34

C:\Users\Admin\AppData\Local\Temp\confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\confirmation.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\confirmation.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qCBhFXqHZ.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qCBhFXqHZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7F4D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7F4D.tmp

Filesize
1KB

MD5
5376fb75b49844a53150159ad215a3b6

SHA1
4ef005bb576323d010734e1fe36c236f6a99e622

SHA256
07a886245c59cfa8437c620c0bcba50efb9f7440c50e596233da342190bd3771

SHA512
8fb0714c34d2d297b8af8d33da4e9f871ea0006e5a31a353ea1764373604a9f6c6367c666121b77a6e0c5bd89b3d3394779e7465cc9dbd1f038fc94f928f91f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W4QDE7F7J110K0GIVLQY.temp

Filesize
7KB

MD5
f06f717129278da13d9ada3e52ff8f07

SHA1
ac18def5f3804b46f39c5beb0ff752c178faaa4f

SHA256
6b3f3a50d57de5ba9ddb5d53908971acca6fb83ec04da5d664d4e6f57aaa7de2

SHA512
70549857e7f604aa5f7322fe2b11329592a9d2eb0aebd3c31a812b6f3a06e1c54374301f76d66d728430f707dc2a1341da62fd6311f1b119221e96116420d467

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f06f717129278da13d9ada3e52ff8f07

SHA1
ac18def5f3804b46f39c5beb0ff752c178faaa4f

SHA256
6b3f3a50d57de5ba9ddb5d53908971acca6fb83ec04da5d664d4e6f57aaa7de2

SHA512
70549857e7f604aa5f7322fe2b11329592a9d2eb0aebd3c31a812b6f3a06e1c54374301f76d66d728430f707dc2a1341da62fd6311f1b119221e96116420d467

Download Submit
memory/2124-21-0x0000000002750000-0x0000000002790000-memory.dmp

Filesize
256KB

Download
memory/2124-28-0x0000000002750000-0x0000000002790000-memory.dmp

Filesize
256KB

Download
memory/2124-34-0x000000006ECA0000-0x000000006F24B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-25-0x0000000002750000-0x0000000002790000-memory.dmp

Filesize
256KB

Download
memory/2124-23-0x000000006ECA0000-0x000000006F24B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-19-0x000000006ECA0000-0x000000006F24B000-memory.dmp

Filesize
5.7MB

Download
memory/2376-27-0x00000000049D0000-0x0000000004A10000-memory.dmp

Filesize
256KB

Download
memory/2376-3-0x0000000000450000-0x0000000000466000-memory.dmp

Filesize
88KB

Download
memory/2376-5-0x00000000052F0000-0x000000000536C000-memory.dmp

Filesize
496KB

Download
memory/2376-0-0x00000000010E0000-0x00000000011B6000-memory.dmp

Filesize
856KB

Download
memory/2376-18-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download
memory/2376-2-0x00000000049D0000-0x0000000004A10000-memory.dmp

Filesize
256KB

Download
memory/2376-1-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download
memory/2376-4-0x00000000006A0000-0x00000000006AA000-memory.dmp

Filesize
40KB

Download
memory/2440-24-0x00000000025A0000-0x00000000025E0000-memory.dmp

Filesize
256KB

Download
memory/2440-22-0x000000006ECA0000-0x000000006F24B000-memory.dmp

Filesize
5.7MB

Download
memory/2440-26-0x00000000025A0000-0x00000000025E0000-memory.dmp

Filesize
256KB

Download
memory/2440-33-0x000000006ECA0000-0x000000006F24B000-memory.dmp

Filesize
5.7MB

Download
memory/2440-20-0x000000006ECA0000-0x000000006F24B000-memory.dmp

Filesize
5.7MB

Download
memory/2812-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2812-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads