2c2ca8d1a75eef32da01814983a7a3dbddff14915ae96346af68dc29c65db7ea

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ABP Overdue.exe
Size 918KB
Sample240123-sx2bdsbegp
SHA256 2c2ca8d1a75eef32da01814983a7a3dbddff14915ae96346af68dc29c65db7ea
MD5 dc8adcc624f9599d45e5e3b63411e4c7
SHA1 65f0b0f038f3969d5080ec79ce559093b217c467
SHA512 51443b901a0abd5a74d69e22ec66367604a3b4005256efe3c96c843e5873ec158cec4dcc647508ca682975434514cf88977f170b6586bc31ae69b360919ce41e
SSDEEP 12288:mlUgySozdUd283S5qgkFCxjI4s+gGL+i7vJ0TG/r7jam+VM/NwNVJdPFZdVBo6U1:8mFudCDkFCx84OG9Brj7emT/NCVJdz
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2984	ABP Overdue.exe
2620	powershell.exe
2976	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	ABP Overdue.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2976	2984	ABP Overdue.exe	28
PID 2984 wrote to memory of 2976	2984	ABP Overdue.exe	28
PID 2984 wrote to memory of 2976	2984	ABP Overdue.exe	28
PID 2984 wrote to memory of 2976	2984	ABP Overdue.exe	28
PID 2984 wrote to memory of 2620	2984	ABP Overdue.exe	30
PID 2984 wrote to memory of 2620	2984	ABP Overdue.exe	30
PID 2984 wrote to memory of 2620	2984	ABP Overdue.exe	30
PID 2984 wrote to memory of 2620	2984	ABP Overdue.exe	30
PID 2984 wrote to memory of 2584	2984	ABP Overdue.exe	32
PID 2984 wrote to memory of 2584	2984	ABP Overdue.exe	32
PID 2984 wrote to memory of 2584	2984	ABP Overdue.exe	32
PID 2984 wrote to memory of 2584	2984	ABP Overdue.exe	32
PID 2984 wrote to memory of 840	2984	ABP Overdue.exe	34
PID 2984 wrote to memory of 840	2984	ABP Overdue.exe	34
PID 2984 wrote to memory of 840	2984	ABP Overdue.exe	34
PID 2984 wrote to memory of 840	2984	ABP Overdue.exe	34
PID 2984 wrote to memory of 1900	2984	ABP Overdue.exe	35
PID 2984 wrote to memory of 1900	2984	ABP Overdue.exe	35
PID 2984 wrote to memory of 1900	2984	ABP Overdue.exe	35
PID 2984 wrote to memory of 1900	2984	ABP Overdue.exe	35
PID 2984 wrote to memory of 2908	2984	ABP Overdue.exe	36
PID 2984 wrote to memory of 2908	2984	ABP Overdue.exe	36
PID 2984 wrote to memory of 2908	2984	ABP Overdue.exe	36
PID 2984 wrote to memory of 2908	2984	ABP Overdue.exe	36
PID 2984 wrote to memory of 524	2984	ABP Overdue.exe	37
PID 2984 wrote to memory of 524	2984	ABP Overdue.exe	37
PID 2984 wrote to memory of 524	2984	ABP Overdue.exe	37
PID 2984 wrote to memory of 524	2984	ABP Overdue.exe	37
PID 2984 wrote to memory of 2948	2984	ABP Overdue.exe	38
PID 2984 wrote to memory of 2948	2984	ABP Overdue.exe	38
PID 2984 wrote to memory of 2948	2984	ABP Overdue.exe	38
PID 2984 wrote to memory of 2948	2984	ABP Overdue.exe	38

C:\Users\Admin\AppData\Local\Temp\ABP Overdue.exe
"C:\Users\Admin\AppData\Local\Temp\ABP Overdue.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ABP Overdue.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VpfYGImQGmj.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VpfYGImQGmj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC571.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2584
- C:\Users\Admin\AppData\Local\Temp\ABP Overdue.exe
  "C:\Users\Admin\AppData\Local\Temp\ABP Overdue.exe"
  2⤵
  PID:840
- C:\Users\Admin\AppData\Local\Temp\ABP Overdue.exe
  "C:\Users\Admin\AppData\Local\Temp\ABP Overdue.exe"
  2⤵
  PID:1900
- C:\Users\Admin\AppData\Local\Temp\ABP Overdue.exe
  "C:\Users\Admin\AppData\Local\Temp\ABP Overdue.exe"
  2⤵
  PID:2908
- C:\Users\Admin\AppData\Local\Temp\ABP Overdue.exe
  "C:\Users\Admin\AppData\Local\Temp\ABP Overdue.exe"
  2⤵
  PID:524
- C:\Users\Admin\AppData\Local\Temp\ABP Overdue.exe
  "C:\Users\Admin\AppData\Local\Temp\ABP Overdue.exe"
  2⤵
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpC571.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpC571.tmp
Size 1KB
SHA256 9cb820a3770d2dedf75536bfd8c55ab271ab99e7c65f24d2c4af961342da877d
MD5 1f195de9be6c404b2d7c8712a119c7f9
SHA1 c90878868ee06c81c452bd009231fa2d08834606
SHA512 f9eedee58c71b0099c974c088a25edbb84a350434fbca2e948b44fa736a38ab5b0e692b147961b4fe892da254c8dca07f871c501e6f4cec8f86507a55fe87a6d
MD5 SHA1 SHA512

Submit Download

WIBWUQDRQ42MHTI6M12V.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WIBWUQDRQ42MHTI6M12V.temp
Size 7KB
SHA256 c97c452fcbe63e362408c02eab1a3024d59aea188aa894a50a799a927276c10a
MD5 21fb529708da04e639b59ec876f278ff
SHA1 e7396698fc1fb72d44a565730ca8220ac72bc394
SHA512 8fac068511c6e720f6bc3e4eaaa9a31f3058082ea46c844e8494ec9a64df1e64fbf4f1cb5efad73b41f4cacd7a75853ef8d72531f3895780bcc5ea326c99ac01
SSDEEP 96:ERaCAiM8VnqvsqvJCwoJXRaCAiM8VnqvsEHyqvJCworLKMYJQHjo7zCXlUVsN:sLxUoJBLxAHnorLKh6o7zCJN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2620-30-0x000000006F150000-0x000000006F6FB000-memory.dmp

Download

memory/2620-28-0x00000000026B0000-0x00000000026F0000-memory.dmp

Download

memory/2620-26-0x000000006F150000-0x000000006F6FB000-memory.dmp

Download

memory/2620-24-0x00000000026B0000-0x00000000026F0000-memory.dmp

Download

memory/2620-21-0x000000006F150000-0x000000006F6FB000-memory.dmp

Download

memory/2976-25-0x000000006F150000-0x000000006F6FB000-memory.dmp

Download

memory/2976-23-0x000000006F150000-0x000000006F6FB000-memory.dmp

Download

memory/2976-29-0x000000006F150000-0x000000006F6FB000-memory.dmp

Download

memory/2976-27-0x00000000026B0000-0x00000000026F0000-memory.dmp

Download

memory/2984-5-0x00000000008A0000-0x00000000008AC000-memory.dmp

Download

memory/2984-8-0x0000000007250000-0x0000000007290000-memory.dmp

Download

memory/2984-22-0x0000000074570000-0x0000000074C5E000-memory.dmp

Download

memory/2984-4-0x0000000000600000-0x0000000000608000-memory.dmp

Download

memory/2984-0-0x0000000000370000-0x000000000045C000-memory.dmp

Download

memory/2984-3-0x00000000004B0000-0x00000000004C4000-memory.dmp

Download

memory/2984-6-0x0000000007690000-0x0000000007732000-memory.dmp

Download

memory/2984-2-0x0000000007250000-0x0000000007290000-memory.dmp

Download

memory/2984-1-0x0000000074570000-0x0000000074C5E000-memory.dmp

Download

memory/2984-7-0x0000000074570000-0x0000000074C5E000-memory.dmp

Download