Analysis
-
max time kernel
46s -
max time network
68s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 01:52
Static task
static1
Behavioral task
behavioral1
Sample
PO24535363.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
PO24535363.exe
Resource
win10v2004-20231215-en
General
-
Target
PO24535363.exe
-
Size
810KB
-
MD5
cad47481ee480d7808407d1b82c59d6b
-
SHA1
ea048eee92361095b568fbc8de772a6788e186d1
-
SHA256
590387feecd3df6131ffd646c5e4a9e597b6e216c56d7a1eb010b16164281144
-
SHA512
4d245ed227a62e2b3c2dfca61f20bc6fa5c81c09ca1c87c0292f21db39a936c81942f37f365b3357348aa022508d19bd152285d0930efd7e7633c355c9c115e6
-
SSDEEP
12288:GxdOwKLvAcdZYkMypFtK+1mATyZVKy3jnYZdLKSb55cRANAZCAAb/9nMAzN4F6/c:GnORAcPMO1g3jngBbQQ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4748 schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO24535363.exe"C:\Users\Admin\AppData\Local\Temp\PO24535363.exe"1⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\PO24535363.exe"C:\Users\Admin\AppData\Local\Temp\PO24535363.exe"2⤵PID:2288
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NCgjtGQWUsw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp625.tmp"2⤵
- Creates scheduled task(s)
PID:4748
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"1⤵PID:4128
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO24535363.exe"2⤵PID:1152
-