39c1452e1b81774df4709ace2a464dd98ed1aac7b912279223f222b89763fd92

Analysis

max time kernel
0s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

44cf4281ecd990bdbfe4a443418ee45e.exe
Size

20KB
MD5

44cf4281ecd990bdbfe4a443418ee45e
SHA1

141065ff641584a2c22abbb4663e654466ee5460
SHA256

39c1452e1b81774df4709ace2a464dd98ed1aac7b912279223f222b89763fd92
SHA512

3c933e6bea0271ba8f4794b02a07cb412717b6e5ff0fa7f590c5b2ed2738c87ad2491faae1956f097fb3365122ed630e6f56db2693c25529e70e60b12f9bac75
SSDEEP

384:qsmVL3GIKe2P12MF7ZGU6RlA66lvV4yqkhaQYIg:qvVjG2ZU5lN4yFaLH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2408	tago.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tago.exe	44cf4281ecd990bdbfe4a443418ee45e.exe
File opened for modification	C:\Windows\SysWOW64\tago.exe	44cf4281ecd990bdbfe4a443418ee45e.exe

Kills process with taskkill 17 IoCs

evasion

pid	Process
2144	taskkill.exe
4836	taskkill.exe
2288	taskkill.exe
2284	taskkill.exe
1652	taskkill.exe
4472	taskkill.exe
2160	taskkill.exe
3192	taskkill.exe
2244	taskkill.exe
3296	taskkill.exe
1924	taskkill.exe
2056	taskkill.exe
1876	taskkill.exe
2388	taskkill.exe
832	taskkill.exe
1652	taskkill.exe
4572	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2164	44cf4281ecd990bdbfe4a443418ee45e.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1448	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	55
PID 2164 wrote to memory of 1448	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	55
PID 2164 wrote to memory of 1448	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	55
PID 2164 wrote to memory of 2732	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	54
PID 2164 wrote to memory of 2732	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	54
PID 2164 wrote to memory of 2732	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	54
PID 2164 wrote to memory of 1832	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	53
PID 2164 wrote to memory of 1832	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	53
PID 2164 wrote to memory of 1832	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	53
PID 2164 wrote to memory of 1444	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	52
PID 2164 wrote to memory of 1444	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	52
PID 2164 wrote to memory of 1444	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	52
PID 2164 wrote to memory of 1508	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	51
PID 2164 wrote to memory of 1508	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	51
PID 2164 wrote to memory of 1508	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	51
PID 2408 wrote to memory of 4512	2408	tago.exe	43
PID 2408 wrote to memory of 4512	2408	tago.exe	43
PID 2408 wrote to memory of 4512	2408	tago.exe	43
PID 2408 wrote to memory of 3420	2408	tago.exe	42
PID 2408 wrote to memory of 3420	2408	tago.exe	42
PID 2408 wrote to memory of 3420	2408	tago.exe	42
PID 2408 wrote to memory of 2948	2408	tago.exe	41
PID 2408 wrote to memory of 2948	2408	tago.exe	41
PID 2408 wrote to memory of 2948	2408	tago.exe	41
PID 2408 wrote to memory of 1852	2408	tago.exe	40
PID 2408 wrote to memory of 1852	2408	tago.exe	40
PID 2408 wrote to memory of 1852	2408	tago.exe	40
PID 2408 wrote to memory of 5092	2408	tago.exe	39
PID 2408 wrote to memory of 5092	2408	tago.exe	39
PID 2408 wrote to memory of 5092	2408	tago.exe	39
PID 2164 wrote to memory of 5052	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	38
PID 2164 wrote to memory of 5052	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	38
PID 2164 wrote to memory of 5052	2164	44cf4281ecd990bdbfe4a443418ee45e.exe	38
PID 1448 wrote to memory of 2388	1448	cmd.exe	18
PID 1448 wrote to memory of 2388	1448	cmd.exe	18
PID 1448 wrote to memory of 2388	1448	cmd.exe	18
PID 3420 wrote to memory of 832	3420	cmd.exe	35
PID 3420 wrote to memory of 832	3420	cmd.exe	35
PID 3420 wrote to memory of 832	3420	cmd.exe	35
PID 2732 wrote to memory of 2284	2732	cmd.exe	20
PID 2732 wrote to memory of 2284	2732	cmd.exe	20
PID 2732 wrote to memory of 2284	2732	cmd.exe	20
PID 4512 wrote to memory of 4836	4512	cmd.exe	33
PID 4512 wrote to memory of 4836	4512	cmd.exe	33
PID 4512 wrote to memory of 4836	4512	cmd.exe	33
PID 1444 wrote to memory of 2160	1444	cmd.exe	34
PID 1444 wrote to memory of 2160	1444	cmd.exe	34
PID 1444 wrote to memory of 2160	1444	cmd.exe	34
PID 2948 wrote to memory of 4472	2948	cmd.exe	131
PID 2948 wrote to memory of 4472	2948	cmd.exe	131
PID 2948 wrote to memory of 4472	2948	cmd.exe	131
PID 1832 wrote to memory of 1924	1832	cmd.exe	25
PID 1832 wrote to memory of 1924	1832	cmd.exe	25
PID 1832 wrote to memory of 1924	1832	cmd.exe	25

C:\Users\Admin\AppData\Local\Temp\44cf4281ecd990bdbfe4a443418ee45e.exe
"C:\Users\Admin\AppData\Local\Temp\44cf4281ecd990bdbfe4a443418ee45e.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\44CF42~1.EXE > nul
  2⤵
  PID:5052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwproxy.exe
  2⤵
  PID:1508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwstub.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwsrv.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im rfwmain.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im 360tray.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1448

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 360tray.exe
1⤵
- Kills process with taskkill
PID:2388

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfwmain.exe
1⤵
- Kills process with taskkill
PID:2284

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfwproxy.exe
1⤵
- Kills process with taskkill
PID:2144

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfwproxy.exe
1⤵
- Kills process with taskkill
PID:3296

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfwstub.exe
1⤵
- Kills process with taskkill
PID:1652

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfwsrv.exe
1⤵
- Kills process with taskkill
PID:1924

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 360tray.exe
1⤵
- Kills process with taskkill
PID:2056

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im 360tray.exe
1⤵
PID:2676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfwsrv.exe
1⤵
- Kills process with taskkill
PID:4472

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 360tray.exe
1⤵
- Kills process with taskkill
PID:4836

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfwstub.exe
1⤵
- Kills process with taskkill
PID:2160

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rfwmain.exe
1⤵
- Kills process with taskkill
PID:832

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im rfwproxy.exe
1⤵
PID:5092

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im rfwstub.exe
1⤵
PID:1852

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im rfwsrv.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im rfwmain.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3420

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im 360tray.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\SysWOW64\tago.exe
C:\Windows\SysWOW64\tago.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im 360tray.exe
  2⤵
  PID:3956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im 360tray.exe
  2⤵
  PID:1540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im 360tray.exe
  2⤵
  PID:3116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im 360tray.exe
  2⤵
  PID:432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im 360tray.exe
  2⤵
  PID:1584
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im 360tray.exe
  2⤵
  PID:1348

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 3905895f591409d6a11d52b3cd9a788e QxvjAC1GY0q32RgPEpoTig.0.1.0.0.0
1⤵
PID:4472

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 360tray.exe
1⤵
- Kills process with taskkill
PID:3192

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 360tray.exe
1⤵
- Kills process with taskkill
PID:2288

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 360tray.exe
1⤵
- Kills process with taskkill
PID:1652

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 360tray.exe
1⤵
- Kills process with taskkill
PID:1876

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 360tray.exe
1⤵
- Kills process with taskkill
PID:4572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im 360tray.exe
1⤵
- Kills process with taskkill
PID:2244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\tago.exe

Filesize
20KB

MD5
44cf4281ecd990bdbfe4a443418ee45e

SHA1
141065ff641584a2c22abbb4663e654466ee5460

SHA256
39c1452e1b81774df4709ace2a464dd98ed1aac7b912279223f222b89763fd92

SHA512
3c933e6bea0271ba8f4794b02a07cb412717b6e5ff0fa7f590c5b2ed2738c87ad2491faae1956f097fb3365122ed630e6f56db2693c25529e70e60b12f9bac75

Download Submit