5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7

General

Target
5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe
Size 16KB
Sample240319-xfb3dscc7s
SHA256 5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7
MD5 b3c53eb5851703358e2bfacec3b19aa4
SHA1 8cf5d03b5522e2f24187f04c0d3ab556fe3d1686
SHA512 7fc70fc6a99f2dc00eb5c9acdacde40d1b4c3a4d4395b47bf637f3de6c8468f837c023a327feb3b03ce91a73a168132d481897511c78bd0f8a28dd4cf300bc16
SSDEEP 384:26kyHLpL3LxYLTLc8VcpOjAM+o/8E9VF0NyFbm:26XHFz1YnwscpOjAMxkEK
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-160263616-143223877-1356318919-1000\Software\Microsoft\Windows\CurrentVersion\Run\RtkAudUApp64 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe"	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 8	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	80
PID 5008 wrote to memory of 8	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	80
PID 5008 wrote to memory of 4600	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	82
PID 5008 wrote to memory of 4600	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	82
PID 5008 wrote to memory of 1348	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	83
PID 5008 wrote to memory of 1348	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	83
PID 5008 wrote to memory of 4956	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	84
PID 5008 wrote to memory of 4956	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	84
PID 5008 wrote to memory of 3708	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	85
PID 5008 wrote to memory of 3708	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	85
PID 5008 wrote to memory of 3288	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	86
PID 5008 wrote to memory of 3288	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	86
PID 5008 wrote to memory of 2892	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	88
PID 5008 wrote to memory of 2892	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	88
PID 5008 wrote to memory of 3088	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	89
PID 5008 wrote to memory of 3088	5008	5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe	89

C:\Users\Admin\AppData\Local\Temp\5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe
"C:\Users\Admin\AppData\Local\Temp\5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Control.exe
  2⤵
  PID:8
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Anyns.exe
  2⤵
  PID:4600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Header.exe
  2⤵
  PID:1348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:4956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\
  2⤵
  PID:3708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Taskhost.exe
  2⤵
  PID:3288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Runtime.exe
  2⤵
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\Sideload\
  2⤵
  PID:3088