aa9422b99ef5c3e4176166a72def257d40974bb7b7cd9ec87fdf3179224ea013

General

Target

Loading Advice.exe
Size

670KB
MD5

0e2cf387d4c9e428e4fe7426267dcf78
SHA1

6b9d263c151a33ed3f4a190ff946d52220e0f4f9
SHA256

4f632d095e16ece2c5dfae8a7960012ae4c94d5d8420c1a4370161d7eb2cf16d
SHA512

fb006aefc41f72b39ab9c6d45056af8bc8c52ade79aa4991977535632075ee555d74495eae741c9a19c28461d3da853d8d07d8ceaba8364c0e2fdd46d614ccc4
SSDEEP

12288:B7NtLK1lOYgzMEcgyAZx94KgLGeq/tsWzsCywR8Sk4:hicNQ+xCKaGhloPT

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2640 schtasks.exe

pid	process
2640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

Loading Advice.exepowershell.exepowershell.exe

pid	process
2880	Loading Advice.exe
2880	Loading Advice.exe
2880	Loading Advice.exe
2880	Loading Advice.exe
2880	Loading Advice.exe
2880	Loading Advice.exe
2880	Loading Advice.exe
2880	Loading Advice.exe
2880	Loading Advice.exe
2880	Loading Advice.exe
2880	Loading Advice.exe
2880	Loading Advice.exe
2988	powershell.exe
2540	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Loading Advice.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2880 Loading Advice.exe
Token: SeDebugPrivilege 2988 powershell.exe
Token: SeDebugPrivilege 2540 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2880	Loading Advice.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	2540	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

Loading Advice.exe

description	pid	process	target process
PID 2880 wrote to memory of 2988	2880	Loading Advice.exe	powershell.exe
PID 2880 wrote to memory of 2988	2880	Loading Advice.exe	powershell.exe
PID 2880 wrote to memory of 2988	2880	Loading Advice.exe	powershell.exe
PID 2880 wrote to memory of 2988	2880	Loading Advice.exe	powershell.exe
PID 2880 wrote to memory of 2540	2880	Loading Advice.exe	powershell.exe
PID 2880 wrote to memory of 2540	2880	Loading Advice.exe	powershell.exe
PID 2880 wrote to memory of 2540	2880	Loading Advice.exe	powershell.exe
PID 2880 wrote to memory of 2540	2880	Loading Advice.exe	powershell.exe
PID 2880 wrote to memory of 2640	2880	Loading Advice.exe	schtasks.exe
PID 2880 wrote to memory of 2640	2880	Loading Advice.exe	schtasks.exe
PID 2880 wrote to memory of 2640	2880	Loading Advice.exe	schtasks.exe
PID 2880 wrote to memory of 2640	2880	Loading Advice.exe	schtasks.exe
PID 2880 wrote to memory of 2712	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2712	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2712	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2712	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2772	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2772	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2772	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2772	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2940	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2940	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2940	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2940	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2204	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2204	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2204	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2204	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2724	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2724	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2724	2880	Loading Advice.exe	Loading Advice.exe
PID 2880 wrote to memory of 2724	2880	Loading Advice.exe	Loading Advice.exe

C:\Users\Admin\AppData\Local\Temp\Loading Advice.exe
"C:\Users\Admin\AppData\Local\Temp\Loading Advice.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Loading Advice.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SOhaQHvG.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SOhaQHvG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp642F.tmp"
2⤵
- Creates scheduled task(s)
PID:2640

C:\Users\Admin\AppData\Local\Temp\Loading Advice.exe
"C:\Users\Admin\AppData\Local\Temp\Loading Advice.exe"
2⤵
PID:2712

C:\Users\Admin\AppData\Local\Temp\Loading Advice.exe
"C:\Users\Admin\AppData\Local\Temp\Loading Advice.exe"
2⤵
PID:2772

C:\Users\Admin\AppData\Local\Temp\Loading Advice.exe
"C:\Users\Admin\AppData\Local\Temp\Loading Advice.exe"
2⤵
PID:2940

C:\Users\Admin\AppData\Local\Temp\Loading Advice.exe
"C:\Users\Admin\AppData\Local\Temp\Loading Advice.exe"
2⤵
PID:2204

C:\Users\Admin\AppData\Local\Temp\Loading Advice.exe
"C:\Users\Admin\AppData\Local\Temp\Loading Advice.exe"
2⤵
PID:2724

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp642F.tmp
Filesize
1KB

MD5
0746b54a08795ce6e1dc885c58bc4aa4

SHA1
71e4ee032f0ea61ee210262ce98309af8ec803d9

SHA256
22249261b6fe369456bed8f9f0cf1b32766c1b2bc4526ce744981a02dfad677a

SHA512
a2f5ddbc378e6a3221da1a6840b0a2106161866e4fbb8d1c1015268f1b42bbaaba07ca8a0cb5a351755e776148204f3a3fd655beafb1ec3b630491d3bdb4ae5f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
852c45cff827ee755ab83454c9226708

SHA1
04123727a35326d46c19b68142e61cdfaea4fb67

SHA256
9b777bcdcbb6e292a414b34a9cf04cfb86156f2827ac0c370f173abcf6c30c70

SHA512
2d884dd6d576faada173b312c3c4b8e7cfa16003788fc7b233918260f73f22646d9ac1a486ce8fc1b8e086ca82b6238c267cec3d621bb393f006e230d81bd0cb

Download Submit
memory/2540-29-0x000000006F130000-0x000000006F6DB000-memory.dmp

Filesize
5.7MB

Download
memory/2540-26-0x00000000023D0000-0x0000000002410000-memory.dmp

Filesize
256KB

Download
memory/2540-25-0x00000000023D0000-0x0000000002410000-memory.dmp

Filesize
256KB

Download
memory/2540-22-0x000000006F130000-0x000000006F6DB000-memory.dmp

Filesize
5.7MB

Download
memory/2540-18-0x000000006F130000-0x000000006F6DB000-memory.dmp

Filesize
5.7MB

Download
memory/2880-5-0x00000000053A0000-0x0000000005422000-memory.dmp

Filesize
520KB

Download
memory/2880-0-0x0000000000370000-0x000000000041E000-memory.dmp

Filesize
696KB

Download
memory/2880-19-0x0000000074600000-0x0000000074CEE000-memory.dmp

Filesize
6.9MB

Download
memory/2880-4-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/2880-3-0x0000000000510000-0x000000000052A000-memory.dmp

Filesize
104KB

Download
memory/2880-2-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download
memory/2880-1-0x0000000074600000-0x0000000074CEE000-memory.dmp

Filesize
6.9MB

Download
memory/2988-20-0x000000006F130000-0x000000006F6DB000-memory.dmp

Filesize
5.7MB

Download
memory/2988-21-0x0000000002400000-0x0000000002440000-memory.dmp

Filesize
256KB

Download
memory/2988-23-0x000000006F130000-0x000000006F6DB000-memory.dmp

Filesize
5.7MB

Download
memory/2988-24-0x0000000002400000-0x0000000002440000-memory.dmp

Filesize
256KB

Download
memory/2988-27-0x0000000002400000-0x0000000002440000-memory.dmp

Filesize
256KB

Download
memory/2988-28-0x000000006F130000-0x000000006F6DB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads