Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01-12-2023 17:10
Static task
static1
Behavioral task
behavioral1
Sample
e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe
Resource
win10v2004-20231127-en
General
-
Target
e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe
-
Size
611KB
-
MD5
f32a6ab75017b52d706244fa0df72efb
-
SHA1
cf1797c6665d35a4fd3fb04c46889f4ecf92a5ad
-
SHA256
e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f
-
SHA512
2acc9d9d0a120c6be424e524f00a5a58084aa2e7824d2e3a10a51e07d7b728677e24d3d315cebb82fc026dcc1e80b4486885edaa5ff67261cdad07a78ba10a8b
-
SSDEEP
12288:eqfLYYZXTyiUzHShUeojAa/Gtaf19vk/adT9VdJNvTvClMQorA1T:1XT5PSSak/adT9XJpTvClMQT1
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exepowershell.exepid process 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe 2632 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exepowershell.exedescription pid process Token: SeDebugPrivilege 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe Token: SeDebugPrivilege 2632 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exedescription pid process target process PID 2968 wrote to memory of 2632 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe powershell.exe PID 2968 wrote to memory of 2632 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe powershell.exe PID 2968 wrote to memory of 2632 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe powershell.exe PID 2968 wrote to memory of 2632 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe powershell.exe PID 2968 wrote to memory of 2696 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe schtasks.exe PID 2968 wrote to memory of 2696 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe schtasks.exe PID 2968 wrote to memory of 2696 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe schtasks.exe PID 2968 wrote to memory of 2696 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe schtasks.exe PID 2968 wrote to memory of 2860 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 2860 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 2860 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 2860 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 2232 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 2232 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 2232 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 2232 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 2500 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 2500 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 2500 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 2500 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 3000 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 3000 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 3000 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 3000 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 2608 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 2608 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 2608 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe PID 2968 wrote to memory of 2608 2968 e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe"C:\Users\Admin\AppData\Local\Temp\e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gWfKzUhu.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gWfKzUhu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDF67.tmp"2⤵
- Creates scheduled task(s)
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe"C:\Users\Admin\AppData\Local\Temp\e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe"2⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe"C:\Users\Admin\AppData\Local\Temp\e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe"2⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe"C:\Users\Admin\AppData\Local\Temp\e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe"2⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe"C:\Users\Admin\AppData\Local\Temp\e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe"2⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe"C:\Users\Admin\AppData\Local\Temp\e31882ee09f143f623d285b74d2b0386c97ff6490154efb0e2bd1a181b13974f.exe"2⤵PID:2608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ebcecb6e84d868bdb5f6bf95f9b2f99c
SHA10267e00b12c4f48b1ab6ef005f93cea8740bd59a
SHA256cb2dadf9f2ed32eb8f57aed84ded7aa2a9199f281192f6b5477b0f9e9d6cc5e4
SHA512a373af97728bea0620fb33eb34e2f302e2372973d09a3758713fc722b7aaf6d49c857a206cdbb0055cbff6333a88e55b8b7719e1ceeda44a87f276e60f1f66ef