Overview

overview

7

Static

static

3

4ee1fe5a7e...18.exe

windows7-x64

7

4ee1fe5a7e...18.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    26-12-2023 03:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4ee1fe5a7eae87277c898e6c98757e18.exe

  • Size

    629KB

  • MD5

    4ee1fe5a7eae87277c898e6c98757e18

  • SHA1

    a39f79d4ed22968ff8c447ea31e532b2fac918f6

  • SHA256

    e6fb06214233bf43c1288b9e491753e2382beaaf170dd27e80a20d19f0273add

  • SHA512

    ce8d99b5e32463628a618c47a7871515d3c068c9cc97411c2b98e7d3109973d33af134d6a56a5cc4ae6553aafd2283f14f0bf2bc48f569ef4a4864a3fdbc9c1c

  • SSDEEP

    12288:wMutR5FemXj/0yN2zISiwKJGwjYI+HiF0N76lKdA3sPxDQoa:USYQyAcSbppN76QdA3sPxDQoa

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ee1fe5a7eae87277c898e6c98757e18.exe
    "C:\Users\Admin\AppData\Local\Temp\4ee1fe5a7eae87277c898e6c98757e18.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exe
      "C:\Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Windows\system32\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp901F.tmp.cmd""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2480
        • C:\Windows\system32\timeout.exe
          timeout 4
          4⤵
          • Delays execution with timeout.exe
          PID:2504
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /f /sc MINUTE /mo 1 /tn "MicrosoftApi" /tr "'C:\Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exe"'
          4⤵
          • Creates scheduled task(s)
          PID:2972
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {F7EE3DBF-8B42-4207-AB7B-6B1F8F5C403C} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exe
      C:\Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp901F.tmp.cmd
    Filesize

    258B

    MD5

    b60bdda171291a5aa4a486e7c917d33a

    SHA1

    94338215169567dc2ea808d20a46e6ed7c946b80

    SHA256

    d8d7a68cf4ccc89a701fd29e2af84a87ef863f7ea55ea0788265e8137c0fbf25

    SHA512

    810ab8fd57afaca6f10c63dcb10d3968e8e12fc29759e76c1ce7f3bf6b1af05a1521ad82fb25ed707535a750a7641a561d53f00896505974a885ec10041919d8

    Download Submit

  • \Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exe
    Filesize

    629KB

    MD5

    4ee1fe5a7eae87277c898e6c98757e18

    SHA1

    a39f79d4ed22968ff8c447ea31e532b2fac918f6

    SHA256

    e6fb06214233bf43c1288b9e491753e2382beaaf170dd27e80a20d19f0273add

    SHA512

    ce8d99b5e32463628a618c47a7871515d3c068c9cc97411c2b98e7d3109973d33af134d6a56a5cc4ae6553aafd2283f14f0bf2bc48f569ef4a4864a3fdbc9c1c

    Download Submit

  • memory/1712-10-0x000007FEF5820000-0x000007FEF620C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1712-1-0x000007FEF5820000-0x000007FEF620C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1712-0-0x000000013F100000-0x000000013F1A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/1984-23-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1984-22-0x000000013F170000-0x000000013F212000-memory.dmp

    Filesize

    648KB

    Download

  • memory/1984-24-0x000000001D100000-0x000000001D180000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1984-25-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1984-26-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2672-11-0x000007FEF5820000-0x000007FEF620C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2672-20-0x000007FEF5820000-0x000007FEF620C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2672-9-0x000000013FD30000-0x000000013FDD2000-memory.dmp

    Filesize

    648KB

    Download