Resubmissions
17/04/2024, 11:57
240417-n4jygadh881017/04/2024, 11:56
240417-n4jbyafe3y1017/04/2024, 11:56
240417-n4bbbsdh821017/04/2024, 11:56
240417-n4ad2afe3v1017/04/2024, 11:56
240417-n3939sdh771017/04/2024, 06:22
240417-g47k7sfg4710Analysis
- max time kernel
316s - max time network
887s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
17/04/2024, 11:56
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral2
Sample
a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe
Resource
win7-20240221-en
windows7-x64
20 signatures
1200 seconds
Behavioral task
behavioral3
Sample
a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1200 seconds
Behavioral task
behavioral4
Sample
a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
19 signatures
1200 seconds
General
- Target a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe
- Size 16.0MB
- Sample240417-n4bbbsdh82
- SHA256 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355
- MD5 a9d06dafb91f15c755391bd9d8360f40
- SHA1 a261feb9c781965e5598f9a1ea5fbbc140fc270b
- SHA512 7b6252b2779aaaecc1f0f10ecd7725e1c35c257bdf62edc689546559649d94c97b319ccf62f23a068fb07a51a9d96688093385de610c4c98495d64f2c6845da4
- SSDEEP 393216:CYkuJyJxES3GqYpKjJxDJ9l4aVjod/ImJcplaF5LASRYTWKGw:9s33YcjXDCEjodSl053Y0w
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3628 CL_Debug_Log.txt - AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral3/files/0x000700000001ac1e-22.dat autoit_exe behavioral3/files/0x000900000001ac1b-28.dat autoit_exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2288 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2600 timeout.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\DFZPKZRM\root\CIMV2 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3628 CL_Debug_Log.txt Token: 35 3628 CL_Debug_Log.txt Token: SeSecurityPrivilege 3628 CL_Debug_Log.txt Token: SeSecurityPrivilege 3628 CL_Debug_Log.txt - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2856 wrote to memory of 3628 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 74 PID 2856 wrote to memory of 3628 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 74 PID 2856 wrote to memory of 3628 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 74 PID 2856 wrote to memory of 716 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 76 PID 2856 wrote to memory of 716 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 76 PID 2856 wrote to memory of 716 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 76 PID 716 wrote to memory of 2288 716 cmd.exe 78 PID 716 wrote to memory of 2288 716 cmd.exe 78 PID 716 wrote to memory of 2288 716 cmd.exe 78 PID 2856 wrote to memory of 4996 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 79 PID 2856 wrote to memory of 4996 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 79 PID 2856 wrote to memory of 4996 2856 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe 79 PID 4996 wrote to memory of 2600 4996 cmd.exe 81 PID 4996 wrote to memory of 2600 4996 cmd.exe 81 PID 4996 wrote to memory of 2600 4996 cmd.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe"C:\Users\Admin\AppData\Local\Temp\a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe"1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txtC:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"2⤵
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"3⤵
- Creates scheduled task(s)
PID:2288
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\A3D0D8~1.EXE"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\A3D0D8~1.EXE" exit)2⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\timeout.exetimeout /t 03⤵
- Delays execution with timeout.exe
PID:2600
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\32.exe
- Size 7.4MB
- SHA256 c995e1ef940d032f41145284cac8d9c31482607deb12f33f1f719e717472004f
- MD5 cccbe69c7b6e39ff66a4a48f838ce52d
- SHA1 339c9ae4d021f862c964607ea620a72d9057d513
- SHA512 28bf29118997c702f84694888326cfb9d75d516825e1434064f8d056d39325fd0770cdcd6877ecb616af281672df86272690f20c19d30092150a33316c3d5c04
- SSDEEP 196608:fCKeChHmuK/igKzbUj7I8+uOAcPZvJadsZCxtO:arCh/3CI3uXcPZesmo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\64.exe
- Size 8.4MB
- SHA256 c67b634151c7759ebdad2ead23447a5c6aec53ccc7191d99250193f21e4916cc
- MD5 573be542141fc76453b670b469f5ada8
- SHA1 b7d07341f7aff6818c3c3c2a699483497e8c5e3f
- SHA512 4359b91e02ab6da228039c760f44aca07702278ec4a991857e889c2e8d40c1f918202941a4390bd95f902a2d06fb04eb1d1583663da623f485c41e5a6b94fc23
- SSDEEP 196608:kbUm3RABKyve7XCPq8YRSJDwCW3gsqcDh2qM2:0USRSKyIXCPlYGwCW3gxkYqM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
- Size 722KB
- SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
- MD5 43141e85e7c36e31b52b22ab94d5e574
- SHA1 cfd7079a9b268d84b856dc668edbb9ab9ef35312
- SHA512 9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc
- SSDEEP 12288:AwAxBpwU5gU+2/9dB5XlH1YAEa5OLW0TjLWG3rn0Yf5ogmn9X9Rf6TIALr22DIVM:AhY2gUfVH5XlVYzagW4/3rn0Y5zmzRfq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt
- Size 14.6MB
- SHA256 5b743067fbde46e8fe7739b3ec5d252a8cb3175984961acacd877290cb795760
- MD5 e8cb9bc0d60ebd8f88da2b3641e365f4
- SHA1 50bfcf9be4aa0bbe5fe69a547c03d7d84ec90d97
- SHA512 52b02257df87ab138e33d8e12b32b37587e15eedf433ce8e95e4ae6fd393410c27face8c7d8028cd41c89899f418f13ed09ade152ba7d82641711030382546e9
- SSDEEP 393216:mBxyn2htyIJ9sZalWs+cF5lAJUWDuUu70ejhXb0ovcPGOOQc:mBo+yIJS4oglAmguR0cFYOQc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml
- Size 2KB
- SHA256 65f9647986a19ab09709a1e45e3e2a8a59de6a34d13762ec84d2ab8a3aa4cbbb
- MD5 6ecac968810e2fcfe2135daef46deb92
- SHA1 8084e94517c38a55f39bbd9b8554e89c89e95be5
- SHA512 5af69976332de9c21abac982284b7e3b123fa622da9676519e76580ca7d35c80e066cf70dc5d7e3c09870b9c4877f6527f6e4dc57f1c5d945accbfce3147e410
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\aut64C5.tmp
- Size 14.6MB
- SHA256 448eda4285eca0473467b861fefc00f14ac901a8864aae5dd380bcbdbaf0cab1
- MD5 eea64418fc0ae00f2b4e86d37e3937de
- SHA1 a33c6550e6f4582d16a481378cb0d199f4ac4b0f
- SHA512 9b7f8e52baab56da7eb616617dad3b05ac30085b90dc22f00990770134bafeaaa4b17bf1ce7b1d833360ca8ef11a08b185a48e00c9debfd003137c2f84fdf305
- SSDEEP 393216:ZBxyn2htyIJ9sZalWs+cF5lAJUWDuUu70ejhXb0ovcPGOOQc:ZBo+yIJS4oglAmguR0cFYOQc
- MD5 SHA1 SHA512 SSDEEP