Analysis
-
max time kernel
123s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-04-2024 01:08
Static task
static1
Behavioral task
behavioral1
Sample
TSTS 0005A.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TSTS 0005A.exe
Resource
win10v2004-20240226-en
General
-
Target
TSTS 0005A.exe
-
Size
922KB
-
MD5
b195643d6d8c3f81c7409533ad14726c
-
SHA1
c09b56928fb1f448ed9b3610a0b930f77e2ebcfe
-
SHA256
f4eaa74eb268a58cff6f5d37607758bd49cc00af060da799857ae10cfd59efb2
-
SHA512
b843153f581be5a77b8575cf09e25333d5eaf5af3b689441ad0af336c4494a6181d5882dfa8b2ba2d90acb64cd3db9ab26f1cf87e1991f996d26cbb6990c5fb8
-
SSDEEP
24576:JgjHr6DLW5Gaxs00MUVXdtS6seDmw+Op8lCua51:WrpDxclG65mg8lCuo
Malware Config
Signatures
-
Detects executables packed with SmartAssembly 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2144-3-0x0000000001D40000-0x0000000001D50000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral1/memory/2144-4-0x0000000001D60000-0x0000000001D6C000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
TSTS 0005A.exepowershell.exepid process 2144 TSTS 0005A.exe 2144 TSTS 0005A.exe 2144 TSTS 0005A.exe 2144 TSTS 0005A.exe 2144 TSTS 0005A.exe 2144 TSTS 0005A.exe 2144 TSTS 0005A.exe 2144 TSTS 0005A.exe 2144 TSTS 0005A.exe 2144 TSTS 0005A.exe 2732 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TSTS 0005A.exepowershell.exedescription pid process Token: SeDebugPrivilege 2144 TSTS 0005A.exe Token: SeDebugPrivilege 2732 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
TSTS 0005A.exedescription pid process target process PID 2144 wrote to memory of 2732 2144 TSTS 0005A.exe powershell.exe PID 2144 wrote to memory of 2732 2144 TSTS 0005A.exe powershell.exe PID 2144 wrote to memory of 2732 2144 TSTS 0005A.exe powershell.exe PID 2144 wrote to memory of 2732 2144 TSTS 0005A.exe powershell.exe PID 2144 wrote to memory of 2608 2144 TSTS 0005A.exe schtasks.exe PID 2144 wrote to memory of 2608 2144 TSTS 0005A.exe schtasks.exe PID 2144 wrote to memory of 2608 2144 TSTS 0005A.exe schtasks.exe PID 2144 wrote to memory of 2608 2144 TSTS 0005A.exe schtasks.exe PID 2144 wrote to memory of 1720 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 1720 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 1720 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 1720 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2452 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2452 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2452 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2452 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2448 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2448 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2448 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2448 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2468 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2468 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2468 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2468 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2484 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2484 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2484 2144 TSTS 0005A.exe TSTS 0005A.exe PID 2144 wrote to memory of 2484 2144 TSTS 0005A.exe TSTS 0005A.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vcEDbAjawlTHE.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vcEDbAjawlTHE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9DB6.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9DB6.tmpFilesize
1KB
MD517052790e32d50230c2c3fc13ddaac9c
SHA10371dff5deae34fe2eda04fd0a1024cccacaf6e5
SHA256cdb7aa026e8d4d4b51131b9e109d9ad02d54355086ac75ef6b683f1c8e9c2654
SHA512810c68bc7e4a42d0d4b18f0620e4d1125f8865e700f03bf71d166f69faab2ce334665d4f5fefc746318c80022427e490548430ac06869a3e13b7c4dd8a0e3b3a
-
memory/2144-3-0x0000000001D40000-0x0000000001D50000-memory.dmpFilesize
64KB
-
memory/2144-2-0x0000000004D10000-0x0000000004D50000-memory.dmpFilesize
256KB
-
memory/2144-0-0x0000000000350000-0x0000000000438000-memory.dmpFilesize
928KB
-
memory/2144-4-0x0000000001D60000-0x0000000001D6C000-memory.dmpFilesize
48KB
-
memory/2144-5-0x0000000005110000-0x00000000051D0000-memory.dmpFilesize
768KB
-
memory/2144-1-0x0000000073BD0000-0x00000000742BE000-memory.dmpFilesize
6.9MB
-
memory/2144-11-0x0000000073BD0000-0x00000000742BE000-memory.dmpFilesize
6.9MB
-
memory/2144-14-0x0000000073BD0000-0x00000000742BE000-memory.dmpFilesize
6.9MB
-
memory/2732-15-0x000000006E350000-0x000000006E8FB000-memory.dmpFilesize
5.7MB
-
memory/2732-16-0x000000006E350000-0x000000006E8FB000-memory.dmpFilesize
5.7MB
-
memory/2732-17-0x0000000002790000-0x00000000027D0000-memory.dmpFilesize
256KB
-
memory/2732-18-0x0000000002790000-0x00000000027D0000-memory.dmpFilesize
256KB
-
memory/2732-19-0x000000006E350000-0x000000006E8FB000-memory.dmpFilesize
5.7MB