1c8eb3bf72bf18166870202c1d9f403c16c7b85df827696cd6f854333a80f5d2

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09a284b7b9eee7c7cca23f6207e6d7d2.exe
Size

33KB
MD5

09a284b7b9eee7c7cca23f6207e6d7d2
SHA1

999768d688e32510b1ea8cdf02afb34d0d47efd4
SHA256

1c8eb3bf72bf18166870202c1d9f403c16c7b85df827696cd6f854333a80f5d2
SHA512

bb57ac22be9448ab3e7a321dc91a05019687c7edb69184154abf0713321135f6c89a272263f01a75ff60c8578840a232d81d9c644cbd3d0ec2a2fed05e15468e
SSDEEP

384:Dw5+1h1UYii+lNppElKelRgr8I4GSFdVp8NAbifwpIgX+FW3el7xI:2+1hS7i+lbpElBqMB3+I/qWQ7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2416	service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2896	schtasks.exe
1200	schtasks.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 792	2900	09a284b7b9eee7c7cca23f6207e6d7d2.exe	28
PID 2900 wrote to memory of 792	2900	09a284b7b9eee7c7cca23f6207e6d7d2.exe	28
PID 2900 wrote to memory of 792	2900	09a284b7b9eee7c7cca23f6207e6d7d2.exe	28
PID 2900 wrote to memory of 792	2900	09a284b7b9eee7c7cca23f6207e6d7d2.exe	28
PID 792 wrote to memory of 1200	792	cmd.exe	30
PID 792 wrote to memory of 1200	792	cmd.exe	30
PID 792 wrote to memory of 1200	792	cmd.exe	30
PID 792 wrote to memory of 1200	792	cmd.exe	30
PID 2704 wrote to memory of 2416	2704	taskeng.exe	34
PID 2704 wrote to memory of 2416	2704	taskeng.exe	34
PID 2704 wrote to memory of 2416	2704	taskeng.exe	34
PID 2704 wrote to memory of 2416	2704	taskeng.exe	34
PID 2416 wrote to memory of 1036	2416	service.exe	35
PID 2416 wrote to memory of 1036	2416	service.exe	35
PID 2416 wrote to memory of 1036	2416	service.exe	35
PID 2416 wrote to memory of 1036	2416	service.exe	35
PID 1036 wrote to memory of 2896	1036	cmd.exe	37
PID 1036 wrote to memory of 2896	1036	cmd.exe	37
PID 1036 wrote to memory of 2896	1036	cmd.exe	37
PID 1036 wrote to memory of 2896	1036	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\09a284b7b9eee7c7cca23f6207e6d7d2.exe
"C:\Users\Admin\AppData\Local\Temp\09a284b7b9eee7c7cca23f6207e6d7d2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %TEMP%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn MyApp /tr C:\Users\Admin\AppData\Local\Temp\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:1200

C:\Windows\system32\taskeng.exe
taskeng.exe {584B8ED4-7424-40B6-921C-0B01A8F30458} S-1-5-21-928733405-3780110381-2966456290-1000:VTILVGXH\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\service.exe
  C:\Users\Admin\AppData\Local\Temp\service.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %TEMP%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn MyApp /tr C:\Users\Admin\AppData\Local\Temp\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
      4⤵
      Creates scheduled task(s)
      PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\service.exe

Filesize
33KB

MD5
09a284b7b9eee7c7cca23f6207e6d7d2

SHA1
999768d688e32510b1ea8cdf02afb34d0d47efd4

SHA256
1c8eb3bf72bf18166870202c1d9f403c16c7b85df827696cd6f854333a80f5d2

SHA512
bb57ac22be9448ab3e7a321dc91a05019687c7edb69184154abf0713321135f6c89a272263f01a75ff60c8578840a232d81d9c644cbd3d0ec2a2fed05e15468e

Download Submit
memory/2416-8-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2900-1-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads