Resubmissions
11/04/2024, 06:38
240411-hd63esha9z 811/04/2024, 06:37
240411-hdp4xaha9x 811/04/2024, 06:37
240411-hdlrgsha9w 811/04/2024, 06:37
240411-hdk5ysha9t 811/04/2024, 06:37
240411-hdkjesha9s 807/04/2024, 08:23
240407-kabhfsgg71 807/04/2024, 08:23
240407-j97t9shc64 807/04/2024, 08:22
240407-j93wbagg7w 807/04/2024, 08:22
240407-j9yatsgg7s 7Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
11/04/2024, 06:37
General
-
Target
tmp.exe
-
Size
5.3MB
-
MD5
5fe4ea367cee11e92ad4644d8ac3cef7
-
SHA1
44faea4a352b7860a9eafca82bd3c9b054b6db29
-
SHA256
1a69f2fcfe5b35bf44ea42a1efe89f18f6b0d522cbbea5c51bae93aff7d3188b
-
SHA512
1c4499eadaf44847a7a001c2622e558bc130c9ad608b4ec977480e002cf50c9eb36a65974b86a2db69e9bc43e7d239122389a6cf1ca2849c59bc137441fb0a4f
-
SSDEEP
98304:lgU5484Bq1qdguoOzv4I3KOn6Ka1uFof9Hn6sdw5yOc4:iU54mqL9zvH3qO
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Executes dropped EXE 3 IoCs
-
Drops file in Windows directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM2⤵
- Creates scheduled task(s)
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\~tl36E5.tmpC:\Users\Admin\AppData\Local\Temp\~tl36E5.tmp3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh int ipv4 set dynamicport tcp start=1025 num=645114⤵
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /TN "Timer"4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM4⤵
- Creates scheduled task(s)
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal4⤵
- Executes dropped EXE
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5cd5b15b46b9fe0d89c2b8d351c303d2a
SHA1e1d30a8f98585e20c709732c013e926c7078a3c2
SHA2560a8a0dcbec27e07c8dc9ef31622ac41591871416ccd9146f40d8cc9a2421da7a
SHA512d7261b2ff89adcdb909b775c6a47b3cd366b7c3f5cbb4f60428e849582c93e14e76d7dcadec79003eef7c9a3059e305d5e4f6b5b912b9ebc3518e06b0d284dd7
-
Filesize
1KB
MD5eae05d42b5e10303a6a8ff9271c9f3ea
SHA1f1db70800544ff57c5fd891c55965c117b9a5276
SHA256b44bcd00507d2be4b86c527edae4f76b690efb7d984f30461749921a79596aa9
SHA512d7143b35a3e9158b1c75c45deb005198e4ce9def7fab6b71afa4a5a6f2b3062f59c5de1815d6e0df04225d08f31f5efba3aa5d22f22e5f9fb4e4d00a38d4d336
-
Filesize
1KB
MD5c2731d4db91c3214276cc3a74441f8c6
SHA1092c464c97b7b01cafb8c9cf0a742b664cc50c4f
SHA2566bd29e9921fd72872837abd2f4c8b75c16af8a36f239f293b9583b51baf673ac
SHA5121e4cd684760da163c4522b723a6e3d93b68171064606c32e7ccc9423235d1295df178c353424e019b5d9fce16ec5e26c064ac4c29ad655161855fed46165951c
-
Filesize
1KB
MD5fbbaf19e5b2817537e1d07c8c2de56eb
SHA113fbdb2f31cddccc5409e96adde9ad413c279606
SHA25653287c07dfd708d1926894db7370197d0adbcb2a65a56c32e24072d0d594ca1a
SHA512c18be68a1d4897d8ac20989866e2aebdfde47e44e5bc26fcfba1bd62ca33d13d8128f08aba036bd59b09a4e6348c9125b634ba01f287ff5f20986ae35002dbde
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
385KB
MD5e802c96760e48c5139995ffb2d891f90
SHA1bba3d278c0eb1094a26e5d2f4c099ad685371578
SHA256cb82ea45a37f8f79d10726a7c165aa5b392b68d5ac954141129c1762a539722c
SHA51297300ac501be6b6ea3ac1915361dd472824fe612801cab8561a02c7df071b1534190d2d5ef872d89d24c8c915b88101e7315f948f53215c2538d661181e3a5f0
-
Filesize
2.7MB
MD5c9b1dde253446b4b2bc6a0ad4d3022c2
SHA166cf356f3717f3d07a1c568c7146f9f9f14adf9f
SHA2564fcc265cafab726d5e03b652e7b3fb4681a28f0dc5349825fe28b5413c96d3f3
SHA5120e8f41766a67cea5d48950d0f30b5c5e1c6b7e9a5d77515e2be72d719c11bed624991c8764c7edddb0981dffd34fbd6e6e89d9ac9bd65164a14b27f21a2ce005
-
Filesize
6.2MB
MD5838b46b300004fab57c1ee0e08dd4e16
SHA1a68ccfded37bd4c67ab02bc9d2576af750947669
SHA256772bb306ef9ff054f7040c370a1a30e1ba01d3b7fb5a1e2a9f866648e2f8037f
SHA512cb926d6f6d46adb5760ff6a254e4ab236e3f3b09938e6049c30bca43a169ed4aafed6d331f65a7eb5a893430aaf9dbe36f832dfd5b12bc84a5b71b46ed0b2fb5
-
Filesize
5.3MB
MD55fe4ea367cee11e92ad4644d8ac3cef7
SHA144faea4a352b7860a9eafca82bd3c9b054b6db29
SHA2561a69f2fcfe5b35bf44ea42a1efe89f18f6b0d522cbbea5c51bae93aff7d3188b
SHA5121c4499eadaf44847a7a001c2622e558bc130c9ad608b4ec977480e002cf50c9eb36a65974b86a2db69e9bc43e7d239122389a6cf1ca2849c59bc137441fb0a4f
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
6.3MB
-
Filesize
6.3MB
-
Filesize
5.0MB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
6.3MB
-
Filesize
6.3MB
-
Filesize
6.3MB
-
Filesize
6.3MB
-
Filesize
6.3MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB