f197f3a4f1a28613822c87e81da383affc805eebfc7f375ee32da141e97c333c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/02/2024, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO-22385.exe
Size 1.2MB
Sample240207-hmhfesedd3
SHA256 f197f3a4f1a28613822c87e81da383affc805eebfc7f375ee32da141e97c333c
MD5 cb2775eef5670f31b9aa08c8e93f319f
SHA1 01349bcc977a41b424c4dc9d07f55c91316e27f5
SHA512 2d948752a523b44c7727a240870a920e49d8563634998fc04de9147e10b6858c09b65672a358c6d0eef56c9cb48019a2c782bed46e99b2195473b56041009681
SSDEEP 24576:LteaUDsdL+b3Lp9XXxexvNirpkn1zTZldvW9cxb:DssdL+7L3XRrunn/e
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
1936	PO-22385.exe
2868	powershell.exe
2464	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	PO-22385.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2868	1936	PO-22385.exe	28
PID 1936 wrote to memory of 2868	1936	PO-22385.exe	28
PID 1936 wrote to memory of 2868	1936	PO-22385.exe	28
PID 1936 wrote to memory of 2868	1936	PO-22385.exe	28
PID 1936 wrote to memory of 2464	1936	PO-22385.exe	30
PID 1936 wrote to memory of 2464	1936	PO-22385.exe	30
PID 1936 wrote to memory of 2464	1936	PO-22385.exe	30
PID 1936 wrote to memory of 2464	1936	PO-22385.exe	30
PID 1936 wrote to memory of 2720	1936	PO-22385.exe	32
PID 1936 wrote to memory of 2720	1936	PO-22385.exe	32
PID 1936 wrote to memory of 2720	1936	PO-22385.exe	32
PID 1936 wrote to memory of 2720	1936	PO-22385.exe	32
PID 1936 wrote to memory of 2512	1936	PO-22385.exe	34
PID 1936 wrote to memory of 2512	1936	PO-22385.exe	34
PID 1936 wrote to memory of 2512	1936	PO-22385.exe	34
PID 1936 wrote to memory of 2512	1936	PO-22385.exe	34
PID 1936 wrote to memory of 2516	1936	PO-22385.exe	35
PID 1936 wrote to memory of 2516	1936	PO-22385.exe	35
PID 1936 wrote to memory of 2516	1936	PO-22385.exe	35
PID 1936 wrote to memory of 2516	1936	PO-22385.exe	35
PID 1936 wrote to memory of 2536	1936	PO-22385.exe	36
PID 1936 wrote to memory of 2536	1936	PO-22385.exe	36
PID 1936 wrote to memory of 2536	1936	PO-22385.exe	36
PID 1936 wrote to memory of 2536	1936	PO-22385.exe	36
PID 1936 wrote to memory of 1956	1936	PO-22385.exe	37
PID 1936 wrote to memory of 1956	1936	PO-22385.exe	37
PID 1936 wrote to memory of 1956	1936	PO-22385.exe	37
PID 1936 wrote to memory of 1956	1936	PO-22385.exe	37
PID 1936 wrote to memory of 2524	1936	PO-22385.exe	38
PID 1936 wrote to memory of 2524	1936	PO-22385.exe	38
PID 1936 wrote to memory of 2524	1936	PO-22385.exe	38
PID 1936 wrote to memory of 2524	1936	PO-22385.exe	38

C:\Users\Admin\AppData\Local\Temp\PO-22385.exe
"C:\Users\Admin\AppData\Local\Temp\PO-22385.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO-22385.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WPasZKJQnCPqBZ.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WPasZKJQnCPqBZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB2BC.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2720
- C:\Users\Admin\AppData\Local\Temp\PO-22385.exe
  "C:\Users\Admin\AppData\Local\Temp\PO-22385.exe"
  2⤵
  PID:2512
- C:\Users\Admin\AppData\Local\Temp\PO-22385.exe
  "C:\Users\Admin\AppData\Local\Temp\PO-22385.exe"
  2⤵
  PID:2516
- C:\Users\Admin\AppData\Local\Temp\PO-22385.exe
  "C:\Users\Admin\AppData\Local\Temp\PO-22385.exe"
  2⤵
  PID:2536
- C:\Users\Admin\AppData\Local\Temp\PO-22385.exe
  "C:\Users\Admin\AppData\Local\Temp\PO-22385.exe"
  2⤵
  PID:1956
- C:\Users\Admin\AppData\Local\Temp\PO-22385.exe
  "C:\Users\Admin\AppData\Local\Temp\PO-22385.exe"
  2⤵
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpB2BC.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpB2BC.tmp
Size 1KB
SHA256 22b4f04cdffc30eb85301e4d087c5f6a09e667a47bac95f9b78e8e61b54ee233
MD5 7e5e1d971b4a9e4d9e2d9278dd1a8dad
SHA1 ed9b170a0493402d5f42034ce9fb966997eee98e
SHA512 3e87ac8e2433438aea1af669dced537b4490fc7c0bd72eef65b4217361b6147a20fed2197ed297a6de0cfa3f0be74ae9413576d4d202ada80f6133896b6f8cde
MD5 SHA1 SHA512

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 580e440e0348593fdb11b25bacfaf006762da799e889cc658d0e1688870e59bd
MD5 aa49c50694fc78238ea8084a4aad9a12
SHA1 69d907c4428bd94e65460085afa0807f500d6dc0
SHA512 39be8c326257bf3951a7721418363f9fb3a37efb4c77dc3c68edd089fc76f10229d6334bab84cf8dec2c2df9571e2c400c3df89a6a0c4ac36ca54203dd6684ec
SSDEEP 96:85aCNM8nnqvsqvJCwoGf/5aCNM8nnqvsEHyqvJCwor8fvV69QHgA7SpXlUV9:kvDUoGfxvDAHnor8fvGNA7SpC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1936-5-0x0000000000630000-0x000000000063E000-memory.dmp

Download

memory/1936-21-0x0000000074990000-0x000000007507E000-memory.dmp

Download

memory/1936-4-0x0000000000620000-0x000000000062A000-memory.dmp

Download

memory/1936-1-0x0000000074990000-0x000000007507E000-memory.dmp

Download

memory/1936-6-0x0000000007F80000-0x0000000008040000-memory.dmp

Download

memory/1936-7-0x0000000074990000-0x000000007507E000-memory.dmp

Download

memory/1936-8-0x0000000004980000-0x00000000049C0000-memory.dmp

Download

memory/1936-2-0x0000000004980000-0x00000000049C0000-memory.dmp

Download

memory/1936-0-0x0000000000340000-0x0000000000476000-memory.dmp

Download

memory/1936-3-0x00000000004D0000-0x00000000004E4000-memory.dmp

Download

memory/2464-22-0x000000006F7F0000-0x000000006FD9B000-memory.dmp

Download

memory/2464-24-0x0000000002780000-0x00000000027C0000-memory.dmp

Download

memory/2464-26-0x0000000002780000-0x00000000027C0000-memory.dmp

Download

memory/2464-25-0x000000006F7F0000-0x000000006FD9B000-memory.dmp

Download

memory/2464-30-0x000000006F7F0000-0x000000006FD9B000-memory.dmp

Download

memory/2868-23-0x0000000000340000-0x0000000000380000-memory.dmp

Download

memory/2868-20-0x000000006F7F0000-0x000000006FD9B000-memory.dmp

Download

memory/2868-27-0x0000000000340000-0x0000000000380000-memory.dmp

Download

memory/2868-28-0x000000006F7F0000-0x000000006FD9B000-memory.dmp

Download

memory/2868-29-0x000000006F7F0000-0x000000006FD9B000-memory.dmp

Download