75db37564d36a9f7cf79c21a1f69c5acc5149d6cf32f270b7799531b0d8b3327

General

Target

AMM Consol 020-04860612.bat.exe
Size

708KB
MD5

3e902a2f0a5c02538f27858309c44e71
SHA1

e5c42d3dcc966129b35fda066267a98f040b765d
SHA256

75db37564d36a9f7cf79c21a1f69c5acc5149d6cf32f270b7799531b0d8b3327
SHA512

17a8708042e49b20013284921ec25fbab64b81a657b75ed7c66e65fd451798775046818a53048e8ae9d12405a9a0f8b03667c285bdf6bf494c20fae5abcdf4e8
SSDEEP

12288:7aFpedTKGZr4NS52Hd5M+Igh/SkjY/oXA9ULcdD1bT78myovhd:Se/r4Hd5H0L9uch98mb

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2788 set thread context of 2564	2788	AMM Consol 020-04860612.bat.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2788	AMM Consol 020-04860612.bat.exe
2788	AMM Consol 020-04860612.bat.exe
2788	AMM Consol 020-04860612.bat.exe
2788	AMM Consol 020-04860612.bat.exe
2788	AMM Consol 020-04860612.bat.exe
2788	AMM Consol 020-04860612.bat.exe
2788	AMM Consol 020-04860612.bat.exe
2788	AMM Consol 020-04860612.bat.exe
2788	AMM Consol 020-04860612.bat.exe
2788	AMM Consol 020-04860612.bat.exe
3004	powershell.exe
1740	powershell.exe
2788	AMM Consol 020-04860612.bat.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2788	AMM Consol 020-04860612.bat.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	1740	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 3004	2788	AMM Consol 020-04860612.bat.exe	28
PID 2788 wrote to memory of 3004	2788	AMM Consol 020-04860612.bat.exe	28
PID 2788 wrote to memory of 3004	2788	AMM Consol 020-04860612.bat.exe	28
PID 2788 wrote to memory of 1740	2788	AMM Consol 020-04860612.bat.exe	35
PID 2788 wrote to memory of 1740	2788	AMM Consol 020-04860612.bat.exe	35
PID 2788 wrote to memory of 1740	2788	AMM Consol 020-04860612.bat.exe	35
PID 2788 wrote to memory of 280	2788	AMM Consol 020-04860612.bat.exe	32
PID 2788 wrote to memory of 280	2788	AMM Consol 020-04860612.bat.exe	32
PID 2788 wrote to memory of 280	2788	AMM Consol 020-04860612.bat.exe	32
PID 2788 wrote to memory of 2564	2788	AMM Consol 020-04860612.bat.exe	36
PID 2788 wrote to memory of 2564	2788	AMM Consol 020-04860612.bat.exe	36
PID 2788 wrote to memory of 2564	2788	AMM Consol 020-04860612.bat.exe	36
PID 2788 wrote to memory of 2564	2788	AMM Consol 020-04860612.bat.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AMM Consol 020-04860612.bat.exe
"C:\Users\Admin\AppData\Local\Temp\AMM Consol 020-04860612.bat.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\AMM Consol 020-04860612.bat.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QzkJCQY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE85C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QzkJCQY.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Users\Admin\AppData\Local\Temp\AMM Consol 020-04860612.bat.exe
  "C:\Users\Admin\AppData\Local\Temp\AMM Consol 020-04860612.bat.exe"
  2⤵
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE85C.tmp

Filesize
1KB

MD5
10ce789a8a84c8b7046f9e215320b8e6

SHA1
785e15fd4ca065d851f65740779834106b80ec21

SHA256
8e16991d2bce9584513fff6eb9a41b3ee7fc4cd5338e49e2e87b9b5759ecf165

SHA512
cff1191ddc6fc8529d54346e2e5053a61fc898f0da5239d5456857a2027fd30502042d4482f73f0931b2a65cdcef78b1e1b8f31ee0c7601d5e887bcea2170079

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
096d11c3a439b08516d6db4ffb584526

SHA1
256775e90048e947511986eb6c03d2569e2d7d02

SHA256
9e6a5e246879980b94f91ab080635fb91d753e7976f9fa7ecf663ff70d8707e2

SHA512
1ca8feb36d4b0e98b7f6b80ad71b7e02831922f3b0d927f65f786018c21be04c3e00b2d7e3efd4cffac34b984561be24a43ae6ab98c7b9f77204f13d19f0ff21

Download Submit
memory/1740-35-0x000007FEEDBA0000-0x000007FEEE53D000-memory.dmp

Filesize
9.6MB

Download
memory/1740-34-0x0000000002AF0000-0x0000000002B70000-memory.dmp

Filesize
512KB

Download
memory/1740-32-0x0000000002AF0000-0x0000000002B70000-memory.dmp

Filesize
512KB

Download
memory/1740-30-0x0000000002AF0000-0x0000000002B70000-memory.dmp

Filesize
512KB

Download
memory/1740-29-0x000007FEEDBA0000-0x000007FEEE53D000-memory.dmp

Filesize
9.6MB

Download
memory/1740-28-0x0000000002AF0000-0x0000000002B70000-memory.dmp

Filesize
512KB

Download
memory/1740-27-0x000007FEEDBA0000-0x000007FEEE53D000-memory.dmp

Filesize
9.6MB

Download
memory/2564-36-0x000007FFFFFDA000-0x000007FFFFFDB000-memory.dmp

Filesize
4KB

Download
memory/2788-6-0x0000000003E10000-0x0000000003E90000-memory.dmp

Filesize
512KB

Download
memory/2788-4-0x00000000007F0000-0x0000000000802000-memory.dmp

Filesize
72KB

Download
memory/2788-39-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2788-1-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2788-2-0x00000000023C0000-0x0000000002440000-memory.dmp

Filesize
512KB

Download
memory/2788-3-0x0000000000740000-0x000000000075A000-memory.dmp

Filesize
104KB

Download
memory/2788-7-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2788-0-0x00000000106B0000-0x0000000010764000-memory.dmp

Filesize
720KB

Download
memory/2788-5-0x0000000000880000-0x0000000000890000-memory.dmp

Filesize
64KB

Download
memory/3004-31-0x000007FEEDBA0000-0x000007FEEE53D000-memory.dmp

Filesize
9.6MB

Download
memory/3004-15-0x0000000002590000-0x0000000002598000-memory.dmp

Filesize
32KB

Download
memory/3004-33-0x000000000283B000-0x00000000028A2000-memory.dmp

Filesize
412KB

Download
memory/3004-14-0x000000001B240000-0x000000001B522000-memory.dmp

Filesize
2.9MB

Download
memory/3004-26-0x0000000002830000-0x00000000028B0000-memory.dmp

Filesize
512KB

Download
memory/3004-25-0x0000000002830000-0x00000000028B0000-memory.dmp

Filesize
512KB

Download
memory/3004-24-0x000007FEEDBA0000-0x000007FEEE53D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads