919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

General

Target

919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
Size

418KB
MD5

0099a99f5ffb3c3ae78af0084136fab3
SHA1

0205a065728a9ec1133e8a372b1e3864df776e8c
SHA256

919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA512

5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
SSDEEP

12288:5noAx+FnmuQhimtPURimLqevmipum+K4Y:5+FnmuGtpMLnLYY

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1740 schtasks.exe

pid	process
1740	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exetaskeng.exe

description	pid	process	target process
PID 2940 wrote to memory of 1740	2940	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe	schtasks.exe
PID 2940 wrote to memory of 1740	2940	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe	schtasks.exe
PID 2940 wrote to memory of 1740	2940	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe	schtasks.exe
PID 2940 wrote to memory of 1740	2940	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe	schtasks.exe
PID 2732 wrote to memory of 2028	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2028	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2028	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2028	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2656	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2656	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2656	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2656	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2528	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2528	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2528	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2528	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2416	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2416	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2416	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2416	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2500	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2500	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2500	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
PID 2732 wrote to memory of 2500	2732	taskeng.exe	919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe

C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
"C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe /TR "C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe" /F
2⤵
- Creates scheduled task(s)
PID:1740

C:\Windows\system32\taskeng.exe
taskeng.exe {35224B2B-E9BA-4FDC-9826-20155BDA2805} S-1-5-21-1861898231-3446828954-4278112889-1000:PTZSFKIF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2732

C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
2⤵
PID:2028

C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
2⤵
PID:2656

C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
2⤵
PID:2528

C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
2⤵
PID:2416

C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
C:\Users\Admin\AppData\Local\Temp\919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226.exe
2⤵
PID:2500