498664cb5f374b3185b39c05b7c0024b52f74815693da3a56a483fd3982ec295

General

Target

e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
Size

2.1MB
MD5

141fab15a9ee48b8caadd462553dbff3
SHA1

36797395bb85f08ac5cf7eacb81c8d9ce78b3701
SHA256

e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454
SHA512

67ff417f350ba875ea4af66088e7bd9f91ee39c52ff4ad27b34526a506efbeb1a14258cca39762d87d8f98f0c6b8427ecc784fc9df4fade95d0f2b3bf86be6ca
SSDEEP

49152:KFMqbjBFzfnVMDpUFvPnA4UCV1a56xd/BOEZb8v/:4M2NVfVMDpUFvmczxB4A

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2860	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	28
PID 2516 wrote to memory of 2860	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	28
PID 2516 wrote to memory of 2860	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	28
PID 2516 wrote to memory of 2860	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	28
PID 2516 wrote to memory of 2692	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	30
PID 2516 wrote to memory of 2692	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	30
PID 2516 wrote to memory of 2692	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	30
PID 2516 wrote to memory of 2692	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	30
PID 2516 wrote to memory of 2884	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	31
PID 2516 wrote to memory of 2884	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	31
PID 2516 wrote to memory of 2884	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	31
PID 2516 wrote to memory of 2884	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	31
PID 2516 wrote to memory of 2616	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	32
PID 2516 wrote to memory of 2616	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	32
PID 2516 wrote to memory of 2616	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	32
PID 2516 wrote to memory of 2616	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	32
PID 2516 wrote to memory of 2904	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	33
PID 2516 wrote to memory of 2904	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	33
PID 2516 wrote to memory of 2904	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	33
PID 2516 wrote to memory of 2904	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	33
PID 2516 wrote to memory of 2876	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	34
PID 2516 wrote to memory of 2876	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	34
PID 2516 wrote to memory of 2876	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	34
PID 2516 wrote to memory of 2876	2516	e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe	34

C:\Users\Admin\AppData\Local\Temp\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
"C:\Users\Admin\AppData\Local\Temp\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SRLHjykjP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6E6C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2860
- C:\Users\Admin\AppData\Local\Temp\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
  "{path}"
  2⤵
  PID:2692
- C:\Users\Admin\AppData\Local\Temp\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
  "{path}"
  2⤵
  PID:2884
- C:\Users\Admin\AppData\Local\Temp\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
  "{path}"
  2⤵
  PID:2616
- C:\Users\Admin\AppData\Local\Temp\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
  "{path}"
  2⤵
  PID:2904
- C:\Users\Admin\AppData\Local\Temp\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
  "{path}"
  2⤵
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6E6C.tmp

Filesize
1KB

MD5
0b52dba0ee6fa2594e8072459c42061f

SHA1
e32832c3405c23e4f413f702685bc6995625f1bb

SHA256
be317588c4995239f0e119cf2fccbe50101f59fafc43d8634be0aae151384cf5

SHA512
4b516ebee4550cbbe9179c37af4fbf9f860ca03f5f2860578c76e7a9fc2ab9bbae475300956fa4cf63a8b7f77e0eb5ee911d057ce80a4b188a8136995328f1ed

Download Submit
memory/2516-1-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2516-0-0x0000000000260000-0x0000000000478000-memory.dmp

Filesize
2.1MB

Download
memory/2516-2-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/2516-3-0x0000000000480000-0x0000000000494000-memory.dmp

Filesize
80KB

Download
memory/2516-4-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2516-5-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/2516-6-0x0000000005910000-0x0000000005AC8000-memory.dmp

Filesize
1.7MB

Download
memory/2516-7-0x000000000AED0000-0x000000000B036000-memory.dmp

Filesize
1.4MB

Download
memory/2516-11-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads