Analysis
-
max time kernel
298s -
max time network
254s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
-
submitted
20-11-2023 04:48
General
-
Target
191ee8fddb80707e4bdb4f13979d521aca69e521aafd0b18736506c789ae2553.exe
-
Size
327KB
-
MD5
0ee8066c8d05d53e5c1e93eaac264542
-
SHA1
bb9ae1109a0d02bd01ad2c29806add30fa01a247
-
SHA256
191ee8fddb80707e4bdb4f13979d521aca69e521aafd0b18736506c789ae2553
-
SHA512
3a87db3b6c853cfc07fe085cff60107e7e9e70b34b269027053777be3932c7eda22c83c13f61a7337de3862929482460ea49ea3a0b7588c799c842463a8efd81
-
SSDEEP
6144:+eTSPhzEBrFDC9/9gh92fZjWHcLdP/ljevLjQGWxylRYLDODv9QJ:zeBEBrFm9/9xZjWwdP/lyTj5WxyOgi
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\191ee8fddb80707e4bdb4f13979d521aca69e521aafd0b18736506c789ae2553.exe"C:\Users\Admin\AppData\Local\Temp\191ee8fddb80707e4bdb4f13979d521aca69e521aafd0b18736506c789ae2553.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9C4F.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\AdobeReader\GeforceUpdater.exe"C:\ProgramData\AdobeReader\GeforceUpdater.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "MicrosoftEdgeUpdateTaskMachineCoreCor" /tr "C:\ProgramData\AdobeReader\GeforceUpdater.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "MicrosoftEdgeUpdateTaskMachineCoreCor" /tr "C:\ProgramData\AdobeReader\GeforceUpdater.exe"5⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\ProgramData\AdobeReader\GeforceUpdater.exeC:\ProgramData\AdobeReader\GeforceUpdater.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
327KB
MD50ee8066c8d05d53e5c1e93eaac264542
SHA1bb9ae1109a0d02bd01ad2c29806add30fa01a247
SHA256191ee8fddb80707e4bdb4f13979d521aca69e521aafd0b18736506c789ae2553
SHA5123a87db3b6c853cfc07fe085cff60107e7e9e70b34b269027053777be3932c7eda22c83c13f61a7337de3862929482460ea49ea3a0b7588c799c842463a8efd81
-
Filesize
327KB
MD50ee8066c8d05d53e5c1e93eaac264542
SHA1bb9ae1109a0d02bd01ad2c29806add30fa01a247
SHA256191ee8fddb80707e4bdb4f13979d521aca69e521aafd0b18736506c789ae2553
SHA5123a87db3b6c853cfc07fe085cff60107e7e9e70b34b269027053777be3932c7eda22c83c13f61a7337de3862929482460ea49ea3a0b7588c799c842463a8efd81
-
Filesize
327KB
MD50ee8066c8d05d53e5c1e93eaac264542
SHA1bb9ae1109a0d02bd01ad2c29806add30fa01a247
SHA256191ee8fddb80707e4bdb4f13979d521aca69e521aafd0b18736506c789ae2553
SHA5123a87db3b6c853cfc07fe085cff60107e7e9e70b34b269027053777be3932c7eda22c83c13f61a7337de3862929482460ea49ea3a0b7588c799c842463a8efd81
-
Filesize
154B
MD59c15a091911c17f4cd1f6d0227ae2b4e
SHA180dee0197af1586af9d10cd11b00243335efc7d1
SHA25628f98dfc445de0c80f6dbf7c4752eca55d6d1a1721ffadce0b3865d8fa9935f1
SHA512ddc5c4edda6902b07cb9da66cfb36fddbd300ea1c4ce5bec559f29fd2a783097603bfcaf02aa9644fd5ee2d57d1698c564e213c7dbde1940eb2a97007a9a7b31
-
Filesize
864KB
-
Filesize
256KB
-
Filesize
624KB
-
Filesize
628KB
-
Filesize
156KB
-
Filesize
1.3MB
-
Filesize
68KB
-
Filesize
988KB
-
Filesize
9.9MB
-
Filesize
864KB
-
Filesize
1.2MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
148KB
-
Filesize
432KB
-
Filesize
1.9MB
-
Filesize
2.3MB
-
Filesize
628KB
-
Filesize
1.1MB
-
Filesize
424KB
-
Filesize
644KB
-
Filesize
156KB
-
Filesize
1.3MB
-
Filesize
324KB
-
Filesize
396KB
-
Filesize
3.0MB
-
Filesize
624KB
-
Filesize
40KB
-
Filesize
9.9MB
-
Filesize
988KB
-
Filesize
1.3MB
-
Filesize
148KB
-
Filesize
432KB
-
Filesize
864KB
-
Filesize
256KB
-
Filesize
1.2MB
-
Filesize
864KB
-
Filesize
256KB
-
Filesize
9.9MB
-
Filesize
864KB
-
Filesize
256KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
864KB
-
Filesize
2.3MB
-
Filesize
424KB
-
Filesize
9.9MB
-
Filesize
864KB
-
Filesize
9.9MB
-
Filesize
1.2MB
-
Filesize
148KB
-
Filesize
432KB
-
Filesize
64KB
-
Filesize
148KB
-
Filesize
816KB
-
Filesize
220KB
-
Filesize
1.9MB
-
Filesize
864KB
-
Filesize
628KB
-
Filesize
1.1MB
-
Filesize
3.0MB
-
Filesize
988KB
-
Filesize
644KB
-
Filesize
324KB
-
Filesize
156KB
-
Filesize
1.3MB
-
Filesize
616KB
-
Filesize
396KB
-
Filesize
864KB
-
Filesize
256KB
-
Filesize
68KB
-
Filesize
1.3MB
-
Filesize
156KB
-
Filesize
628KB
-
Filesize
624KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
9.9MB
-
Filesize
64KB