Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2024, 14:11

General

  • Target

    8c875d52a2ae6452ffe4d3437c916346.exe

  • Size

    262KB

  • MD5

    8c875d52a2ae6452ffe4d3437c916346

  • SHA1

    a8761f0a13f8eb04c8c43820b747340340a896d0

  • SHA256

    3c876e9284562cf9374ba6384a2073aa1043c6dd2be0b0fb9d1075ebb9a84e6c

  • SHA512

    2845291eede1080b9d6ee15ab195212f1253b76ef7fef0a58584db673ecd14e78dded855d336e20349abfa2c9c131e0b93c5d2619e6359054bc8520308bf1ffe

  • SSDEEP

    3072:4LbY/xvmYCOU2+GxOuyKNLRZqExzUNeFbb1EjQIsUBz65/M6If+3Js+3JFkKeTn:4LpGkKxRniIbbKBxBt25

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c875d52a2ae6452ffe4d3437c916346.exe
    "C:\Users\Admin\AppData\Local\Temp\8c875d52a2ae6452ffe4d3437c916346.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /tn NYANP /F
      2⤵
        PID:2044
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\8c875d52a2ae6452ffe4d3437c916346.exe" /sc minute /mo 5
        2⤵
        • Creates scheduled task(s)
        PID:2536
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Delete /tn NYAN /F
        2⤵
          PID:2168
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\8c875d52a2ae6452ffe4d3437c916346.exe" /sc minute /mo 1
          2⤵
          • Creates scheduled task(s)
          PID:2444
      • C:\Windows\system32\taskeng.exe
        taskeng.exe {424C449D-76CC-4F68-868F-5B212D51EAA0} S-1-5-21-1603059206-2004189698-4139800220-1000:AILVMYUM\Admin:Interactive:[1]
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:2728
        • C:\Users\Admin\AppData\Local\Temp\8c875d52a2ae6452ffe4d3437c916346.exe
          C:\Users\Admin\AppData\Local\Temp\8c875d52a2ae6452ffe4d3437c916346.exe
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Delete /tn NYANP /F
            3⤵
              PID:2620
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\8c875d52a2ae6452ffe4d3437c916346.exe" /sc minute /mo 5
              3⤵
              • Creates scheduled task(s)
              PID:1248
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Delete /tn NYAN /F
              3⤵
                PID:2152
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\8c875d52a2ae6452ffe4d3437c916346.exe" /sc minute /mo 1
                3⤵
                • Creates scheduled task(s)
                PID:2264
            • C:\Users\Admin\AppData\Local\Temp\8c875d52a2ae6452ffe4d3437c916346.exe
              C:\Users\Admin\AppData\Local\Temp\8c875d52a2ae6452ffe4d3437c916346.exe
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:796
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Delete /tn NYANP /F
                3⤵
                  PID:1492
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\8c875d52a2ae6452ffe4d3437c916346.exe" /sc minute /mo 5
                  3⤵
                  • Creates scheduled task(s)
                  PID:2144
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Delete /tn NYAN /F
                  3⤵
                    PID:1284
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\8c875d52a2ae6452ffe4d3437c916346.exe" /sc minute /mo 1
                    3⤵
                    • Creates scheduled task(s)
                    PID:2068

              Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • memory/796-22-0x0000000000BE0000-0x0000000000C20000-memory.dmp

                      Filesize

                      256KB

                    • memory/796-16-0x00000000747E0000-0x0000000074D8B000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/796-18-0x00000000747E0000-0x0000000074D8B000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/796-19-0x0000000000BE0000-0x0000000000C20000-memory.dmp

                      Filesize

                      256KB

                    • memory/796-17-0x0000000000BE0000-0x0000000000C20000-memory.dmp

                      Filesize

                      256KB

                    • memory/796-20-0x0000000000BE0000-0x0000000000C20000-memory.dmp

                      Filesize

                      256KB

                    • memory/796-21-0x00000000747E0000-0x0000000074D8B000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/1732-4-0x00000000002F0000-0x0000000000330000-memory.dmp

                      Filesize

                      256KB

                    • memory/1732-8-0x00000000002F0000-0x0000000000330000-memory.dmp

                      Filesize

                      256KB

                    • memory/1732-9-0x00000000002F0000-0x0000000000330000-memory.dmp

                      Filesize

                      256KB

                    • memory/1732-0-0x00000000747E0000-0x0000000074D8B000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/1732-7-0x00000000002F0000-0x0000000000330000-memory.dmp

                      Filesize

                      256KB

                    • memory/1732-6-0x00000000747E0000-0x0000000074D8B000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/1732-5-0x00000000747E0000-0x0000000074D8B000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/1732-3-0x00000000002F0000-0x0000000000330000-memory.dmp

                      Filesize

                      256KB

                    • memory/1732-2-0x00000000002F0000-0x0000000000330000-memory.dmp

                      Filesize

                      256KB

                    • memory/1732-1-0x00000000747E0000-0x0000000074D8B000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/2704-10-0x00000000747E0000-0x0000000074D8B000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/2704-14-0x00000000747E0000-0x0000000074D8B000-memory.dmp

                      Filesize

                      5.7MB

                    • memory/2704-15-0x00000000005E0000-0x0000000000620000-memory.dmp

                      Filesize

                      256KB

                    • memory/2704-13-0x00000000005E0000-0x0000000000620000-memory.dmp

                      Filesize

                      256KB

                    • memory/2704-12-0x00000000005E0000-0x0000000000620000-memory.dmp

                      Filesize

                      256KB

                    • memory/2704-11-0x00000000747E0000-0x0000000074D8B000-memory.dmp

                      Filesize

                      5.7MB