Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
11/12/2023, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
2 - Copy.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral2
Sample
2 - Copy.exe
Resource
win10-20231020-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
2 - Copy.exe
Resource
win10v2004-20231127-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
2 - Copy.exe
Resource
win11-20231128-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
2.exe
Resource
win7-20231130-en
windows7-x64
Behavioral task
behavioral6
Sample
2.exe
Resource
win10-20231129-en
windows10-1703-x64
Behavioral task
behavioral7
Sample
2.exe
Resource
win10v2004-20231130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
2.exe
Resource
win11-20231129-en
windows11-21h2-x64
General
-
Target
2 - Copy.exe
-
Size
902KB
-
MD5
34a98268ac65cb4ab39175f4035d95ef
-
SHA1
37aae493e8ca8caa792fb7a4a26859826f3c28e5
-
SHA256
8e127555bfa80d79e62cf239f53fe66783dc11f5dbe1e42925a0ee9535a85c31
-
SHA512
2c3775145e1397fa8e2ad8c546079a6e747d241d0bdf30478cc97e378fa62fd66445762fe70d24004b720e56b53b42db38d45c0eb8477a2c65ebc19bf7aa1222
-
SSDEEP
6144:cedQzQcAKMRUOUqN+0sE6I9raFU4t9nF20bK4rLxWYqaUGrJ+bHpq1:ced6QmMRrNL6e4TFbEYqazrJMg1
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2296 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe 2508 2 - Copy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2508 2 - Copy.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2296 2508 2 - Copy.exe 29 PID 2508 wrote to memory of 2296 2508 2 - Copy.exe 29 PID 2508 wrote to memory of 2296 2508 2 - Copy.exe 29 PID 2508 wrote to memory of 2496 2508 2 - Copy.exe 31 PID 2508 wrote to memory of 2496 2508 2 - Copy.exe 31 PID 2508 wrote to memory of 2496 2508 2 - Copy.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2 - Copy.exe"C:\Users\Admin\AppData\Local\Temp\2 - Copy.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 1 /tn CClanarTask /tr C:\Users\Admin\AppData\Local\Temp\2 - Copy.exe2⤵
- Creates scheduled task(s)
PID:2296
-
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 5082⤵PID:2496
-