8ebce8791a172ca3e79192d1915a2a0bb7097f96a2714a9435b8854f66d0d99e

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client.exe
Size

1007KB
MD5

c5e3cd63eadc87020b2f18f1e7389cc6
SHA1

a9a29c7d463029bd2977e9a2c02f4ff8ef05dc53
SHA256

8ebce8791a172ca3e79192d1915a2a0bb7097f96a2714a9435b8854f66d0d99e
SHA512

82802dc874e1f3667f73949e2c6a56bfd555241c05b884a5bcfe18cc5afd30924a9211b6b3d435d5e32f4effe802b5adf9a817fddef1b66b8077f87bd9793086
SSDEEP

12288:pyPNutDXlVI3eaJfoRJYwUz9u49LWcTxaMAazKGRBnLk1:p++26JYwUBuKa2zZF

Score

1^/10

Malware Config

Signatures

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4940	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3736	Client.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 4904	3736	Client.exe	91
PID 3736 wrote to memory of 4904	3736	Client.exe	91
PID 4904 wrote to memory of 4940	4904	CMD.exe	93
PID 4904 wrote to memory of 4940	4904	CMD.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "SigmaMoment" /tr "C:\Users\Admin\AppData\Roaming\SigmaMoment" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "SigmaMoment" /tr "C:\Users\Admin\AppData\Roaming\SigmaMoment"
    3⤵
    - Creates scheduled task(s)
    PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3736-0-0x0000000000FF0000-0x00000000010F2000-memory.dmp

Filesize
1.0MB

Download
memory/3736-1-0x00007FFD81760000-0x00007FFD82221000-memory.dmp

Filesize
10.8MB

Download
memory/3736-3-0x00007FFD81760000-0x00007FFD82221000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads