e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c

Resubmissions

17/04/2024, 12:24

240417-pljenaef838

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

16/04/2024, 14:05

Analysis

max time kernel
274s
max time network
307s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16/04/2024, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
Size 5.3MB
Sample240416-rd4rqsde2z
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4344	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File opened for modification	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1008	powershell.exe
1008	powershell.exe
4912	powershell.exe
4912	powershell.exe
4912	powershell.exe
1008	powershell.exe
2812	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
2812	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
4228	powershell.exe
2428	powershell.exe
2428	powershell.exe
4228	powershell.exe
2428	powershell.exe
4228	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeIncreaseQuotaPrivilege	4912	powershell.exe
Token: SeSecurityPrivilege	4912	powershell.exe
Token: SeTakeOwnershipPrivilege	4912	powershell.exe
Token: SeLoadDriverPrivilege	4912	powershell.exe
Token: SeSystemProfilePrivilege	4912	powershell.exe
Token: SeSystemtimePrivilege	4912	powershell.exe
Token: SeProfSingleProcessPrivilege	4912	powershell.exe
Token: SeIncBasePriorityPrivilege	4912	powershell.exe
Token: SeCreatePagefilePrivilege	4912	powershell.exe
Token: SeBackupPrivilege	4912	powershell.exe
Token: SeRestorePrivilege	4912	powershell.exe
Token: SeShutdownPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeSystemEnvironmentPrivilege	4912	powershell.exe
Token: SeRemoteShutdownPrivilege	4912	powershell.exe
Token: SeUndockPrivilege	4912	powershell.exe
Token: SeManageVolumePrivilege	4912	powershell.exe
Token: 33	4912	powershell.exe
Token: 34	4912	powershell.exe
Token: 35	4912	powershell.exe
Token: 36	4912	powershell.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeIncreaseQuotaPrivilege	2428	powershell.exe
Token: SeSecurityPrivilege	2428	powershell.exe
Token: SeTakeOwnershipPrivilege	2428	powershell.exe
Token: SeLoadDriverPrivilege	2428	powershell.exe
Token: SeSystemProfilePrivilege	2428	powershell.exe
Token: SeSystemtimePrivilege	2428	powershell.exe
Token: SeProfSingleProcessPrivilege	2428	powershell.exe
Token: SeIncBasePriorityPrivilege	2428	powershell.exe
Token: SeCreatePagefilePrivilege	2428	powershell.exe
Token: SeBackupPrivilege	2428	powershell.exe
Token: SeRestorePrivilege	2428	powershell.exe
Token: SeShutdownPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeSystemEnvironmentPrivilege	2428	powershell.exe
Token: SeRemoteShutdownPrivilege	2428	powershell.exe
Token: SeUndockPrivilege	2428	powershell.exe
Token: SeManageVolumePrivilege	2428	powershell.exe
Token: 33	2428	powershell.exe
Token: 34	2428	powershell.exe
Token: 35	2428	powershell.exe
Token: 36	2428	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 4912	2812	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	73
PID 2812 wrote to memory of 4912	2812	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	73
PID 2812 wrote to memory of 1008	2812	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	75
PID 2812 wrote to memory of 1008	2812	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	75
PID 2812 wrote to memory of 3860	2812	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	78
PID 2812 wrote to memory of 3860	2812	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	78
PID 2812 wrote to memory of 4344	2812	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	80
PID 2812 wrote to memory of 4344	2812	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	80
PID 4344 wrote to memory of 2428	4344	svchost.exe	82
PID 4344 wrote to memory of 2428	4344	svchost.exe	82
PID 4344 wrote to memory of 4228	4344	svchost.exe	84
PID 4344 wrote to memory of 4228	4344	svchost.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
"C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1008
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:3860
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 0a8a0dcbec27e07c8dc9ef31622ac41591871416ccd9146f40d8cc9a2421da7a
MD5 cd5b15b46b9fe0d89c2b8d351c303d2a
SHA1 e1d30a8f98585e20c709732c013e926c7078a3c2
SHA512 d7261b2ff89adcdb909b775c6a47b3cd366b7c3f5cbb4f60428e849582c93e14e76d7dcadec79003eef7c9a3059e305d5e4f6b5b912b9ebc3518e06b0d284dd7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cc53b485888e0cfb8d3e249e67ff725938043efcaae6471bb99be0cbadf98fbc
MD5 f15ee06d1f3dc28033e789585921ec39
SHA1 dda34f385ee0cfd1ad37c2f3b8c6d74cca4c6110
SHA512 5b74667c3032267ad1a2e2a82fc49ac072886faa47850a3ae651b7a47e6ca9c529524cfadb307b42d2ae643c129496dabe01552694885e353b6a2eb9013be525
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5359ba17f520720cadd8a3cf6dbddd457bd460af3c1f4c4d125914dd9047de83
MD5 6a79264df87867f4f69238d1d3233f20
SHA1 73eabfeedb2350d3f268af52a3ea9a218051e89e
SHA512 131a231aa12067d1b3088671874d95f63532954c431c47a96ed15fe459f9f5f517d7e1a35746fa8ffeb37caafc99584517f4c4c19e866b2cc00d520352437390
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_lkzvg5bi.wsm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lkzvg5bi.wsm.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.6MB
SHA256 19a06742f60483a242577d536b82017ef4111b6abedbd991df49dd6e06e52d6b
MD5 d1bcfb11404cd069703bc0686deee48f
SHA1 d9f14be55fb760c8e3da324b836bce412b2376ec
SHA512 b453658b5aee746d2c350af6ff72bb9615c59bf6a4bd33599fa3efaa39ea099c39b0fc10cd1b199f9995eb0699f3a622fe024404f93db76df578ceb8e5e7bd92
SSDEEP 12288:5GBF3AbRr/MvLqpLAlchjxp3CSAFq15dLXLodwo1AkE1CIScZ4:5tzMzxIG30owHDVp4
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 8.5MB
SHA256 bf60c7303fa366eb8dc3aba22490b89aa183543724f5830ab3ebccbfc3b46fe6
MD5 f8a6907f1fa4a325e44c161d9ec86a17
SHA1 d9c91bbffa3d9232fd8f4a7189a3fe26b0334840
SHA512 0fe6ede8a1244eca425d0399e00f23e195c4c9c36d517b97b67dc8f0de57654718b584e5be4febdf7e45b96e45338214a2fe16b2bc333935153f52cc7739911b
SSDEEP 24576:whDGbTYGboidnrrlsK0pFGpbTBr9NTZstGD0/0F6NnSM84nbFT++3uwt4njAcqCd:F2SBygB9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 5.3MB
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1008-102-0x00007FFCBB3D0000-0x00007FFCBBDBC000-memory.dmp

Download

memory/1008-15-0x00007FFCBB3D0000-0x00007FFCBBDBC000-memory.dmp

Download

memory/1008-16-0x000001FE45A30000-0x000001FE45A40000-memory.dmp

Download

memory/1008-97-0x000001FE45A30000-0x000001FE45A40000-memory.dmp

Download

memory/1008-49-0x000001FE45A30000-0x000001FE45A40000-memory.dmp

Download

memory/1008-13-0x000001FE45B30000-0x000001FE45B52000-memory.dmp

Download

memory/2428-164-0x000001CCCD8E0000-0x000001CCCD8F0000-memory.dmp

Download

memory/2428-220-0x00007FFCBB3D0000-0x00007FFCBBDBC000-memory.dmp

Download

memory/2428-130-0x000001CCCD8E0000-0x000001CCCD8F0000-memory.dmp

Download

memory/2428-124-0x00007FFCBB3D0000-0x00007FFCBBDBC000-memory.dmp

Download

memory/2428-132-0x000001CCCD8E0000-0x000001CCCD8F0000-memory.dmp

Download

memory/2812-0-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2812-4-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2812-2-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2812-3-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2812-1-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2812-115-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4228-216-0x00007FFCBB3D0000-0x00007FFCBBDBC000-memory.dmp

Download

memory/4228-129-0x00007FFCBB3D0000-0x00007FFCBBDBC000-memory.dmp

Download

memory/4228-131-0x00000164AA040000-0x00000164AA050000-memory.dmp

Download

memory/4228-211-0x00000164AA040000-0x00000164AA050000-memory.dmp

Download

memory/4228-133-0x00000164AA040000-0x00000164AA050000-memory.dmp

Download

memory/4228-163-0x00000164AA040000-0x00000164AA050000-memory.dmp

Download

memory/4344-119-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4344-117-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4344-221-0x0000000015640000-0x0000000015B3C000-memory.dmp

Download

memory/4912-18-0x000002763D8F0000-0x000002763D900000-memory.dmp

Download

memory/4912-109-0x00007FFCBB3D0000-0x00007FFCBBDBC000-memory.dmp

Download

memory/4912-104-0x000002763D8F0000-0x000002763D900000-memory.dmp

Download

memory/4912-48-0x000002763D8F0000-0x000002763D900000-memory.dmp

Download

memory/4912-23-0x000002763DBB0000-0x000002763DC26000-memory.dmp

Download

memory/4912-17-0x000002763D8F0000-0x000002763D900000-memory.dmp

Download

memory/4912-14-0x00007FFCBB3D0000-0x00007FFCBBDBC000-memory.dmp

Download