e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c

Resubmissions

17/04/2024, 12:24

240417-pljenaef838

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

16/04/2024, 14:05

Analysis

max time kernel
147s
max time network
160s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
17/04/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
Size 5.3MB
Sample240417-plcbcaef68
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2076	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File opened for modification	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4324	powershell.exe
4300	powershell.exe
4324	powershell.exe
4300	powershell.exe
4324	powershell.exe
4300	powershell.exe
232	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
232	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
1440	powershell.exe
1440	powershell.exe
1308	powershell.exe
1308	powershell.exe
1440	powershell.exe
1308	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	4300	powershell.exe
Token: SeIncreaseQuotaPrivilege	4324	powershell.exe
Token: SeSecurityPrivilege	4324	powershell.exe
Token: SeTakeOwnershipPrivilege	4324	powershell.exe
Token: SeLoadDriverPrivilege	4324	powershell.exe
Token: SeSystemProfilePrivilege	4324	powershell.exe
Token: SeSystemtimePrivilege	4324	powershell.exe
Token: SeProfSingleProcessPrivilege	4324	powershell.exe
Token: SeIncBasePriorityPrivilege	4324	powershell.exe
Token: SeCreatePagefilePrivilege	4324	powershell.exe
Token: SeBackupPrivilege	4324	powershell.exe
Token: SeRestorePrivilege	4324	powershell.exe
Token: SeShutdownPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeSystemEnvironmentPrivilege	4324	powershell.exe
Token: SeRemoteShutdownPrivilege	4324	powershell.exe
Token: SeUndockPrivilege	4324	powershell.exe
Token: SeManageVolumePrivilege	4324	powershell.exe
Token: 33	4324	powershell.exe
Token: 34	4324	powershell.exe
Token: 35	4324	powershell.exe
Token: 36	4324	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeIncreaseQuotaPrivilege	1308	powershell.exe
Token: SeSecurityPrivilege	1308	powershell.exe
Token: SeTakeOwnershipPrivilege	1308	powershell.exe
Token: SeLoadDriverPrivilege	1308	powershell.exe
Token: SeSystemProfilePrivilege	1308	powershell.exe
Token: SeSystemtimePrivilege	1308	powershell.exe
Token: SeProfSingleProcessPrivilege	1308	powershell.exe
Token: SeIncBasePriorityPrivilege	1308	powershell.exe
Token: SeCreatePagefilePrivilege	1308	powershell.exe
Token: SeBackupPrivilege	1308	powershell.exe
Token: SeRestorePrivilege	1308	powershell.exe
Token: SeShutdownPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeSystemEnvironmentPrivilege	1308	powershell.exe
Token: SeRemoteShutdownPrivilege	1308	powershell.exe
Token: SeUndockPrivilege	1308	powershell.exe
Token: SeManageVolumePrivilege	1308	powershell.exe
Token: 33	1308	powershell.exe
Token: 34	1308	powershell.exe
Token: 35	1308	powershell.exe
Token: 36	1308	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 4324	232	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	74
PID 232 wrote to memory of 4324	232	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	74
PID 232 wrote to memory of 4300	232	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	76
PID 232 wrote to memory of 4300	232	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	76
PID 232 wrote to memory of 4384	232	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	79
PID 232 wrote to memory of 4384	232	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	79
PID 232 wrote to memory of 2076	232	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	81
PID 232 wrote to memory of 2076	232	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	81
PID 2076 wrote to memory of 1308	2076	svchost.exe	83
PID 2076 wrote to memory of 1308	2076	svchost.exe	83
PID 2076 wrote to memory of 1440	2076	svchost.exe	85
PID 2076 wrote to memory of 1440	2076	svchost.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
"C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:4384
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 0a8a0dcbec27e07c8dc9ef31622ac41591871416ccd9146f40d8cc9a2421da7a
MD5 cd5b15b46b9fe0d89c2b8d351c303d2a
SHA1 e1d30a8f98585e20c709732c013e926c7078a3c2
SHA512 d7261b2ff89adcdb909b775c6a47b3cd366b7c3f5cbb4f60428e849582c93e14e76d7dcadec79003eef7c9a3059e305d5e4f6b5b912b9ebc3518e06b0d284dd7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 828b7893b1085bcca72911fe1909715d003f9670ac6adaf51a52ddd11a2ba2ab
MD5 aa5edf81798112655a2f0bd22dce6882
SHA1 2fb1b3f2eb08d23b2a9e0edeca93c46cf9500269
SHA512 c0a0114fbf92e4f992239fde8b6bf437a2308ac18736780e792f7c75914aac953bb971c209f63d907a1e9fde67e8dfb9ba94aae45cc2651853316efc7ff777d9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4e7a289e4463d6ab4091a294cdec03e42496a23871d344ad7e99433cf54ff6e6
MD5 25f08c9fa0acb17c473faaa955e7a63f
SHA1 65f1b8837a513414748ff4666588c2fb9058b853
SHA512 a3f291e0c8e3f9bba3056433be5b48026a5879d706b0779bfdab46e14146ff173aea45f56c625745293bc98550e2985cd0eccc8dfe831b126f2ecb7ecabc4714
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_qedcmfgp.5yl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qedcmfgp.5yl.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.6MB
SHA256 6b92f204e74bf781bdd6e46152bf993deb86e367e749a29a47ba65f23d8846ff
MD5 c7e7df0119da2669c8d05dcf0f2cb4c5
SHA1 99324bd69525feb253c665023c9261b3f078818b
SHA512 a9fd3259cbca5411df9791b215348d21b5ddd0cad942131ef852167737ee17f76e62c827edcd22c49868063d1af87d878663a15ec02cb53e8afbb75e19f45bab
SSDEEP 12288:4S9Vw+kOgV86kobS47RSz/wnseNWWFtj+CCHONRQZMgpYek87y:4VVl51WRWWhuNmr9Ly
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 8.4MB
SHA256 f0c165da508b648e4e0e88039d2fce87ecfab05804618cb91500805f7e10fb46
MD5 85d1f60ec3c0430f818506aef53b59bc
SHA1 1ff7f4fac3816ae49e8497b5b0e1609b4d7ea89a
SHA512 cae711f16e8773ecb85c5e86f91f7943d89e575808b3cc7666abf9ccce6ad2c68a17fd0aeade209d16d6495ecdc63622c33f624d252563756b365e429fe36244
SSDEEP 24576:y60fQkVgqBD9fS4wSOPSa1huly844xiRU3O9gHeqw+oQraknZ4fUImOSmrcrA1tV:oB9gaEt0nR7DejP
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 5.3MB
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-4-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/232-0-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/232-3-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/232-116-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/232-1-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/232-2-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/1308-222-0x00007FF8C8AF0000-0x00007FF8C94DC000-memory.dmp

Download

memory/1308-217-0x00000187C06C0000-0x00000187C06D0000-memory.dmp

Download

memory/1308-166-0x00000187C06C0000-0x00000187C06D0000-memory.dmp

Download

memory/1308-131-0x00000187C06C0000-0x00000187C06D0000-memory.dmp

Download

memory/1308-132-0x00000187C06C0000-0x00000187C06D0000-memory.dmp

Download

memory/1308-127-0x00007FF8C8AF0000-0x00007FF8C94DC000-memory.dmp

Download

memory/1440-133-0x000002293FFF0000-0x0000022940000000-memory.dmp

Download

memory/1440-134-0x000002293FFF0000-0x0000022940000000-memory.dmp

Download

memory/1440-218-0x00007FF8C8AF0000-0x00007FF8C94DC000-memory.dmp

Download

memory/1440-214-0x000002293FFF0000-0x0000022940000000-memory.dmp

Download

memory/1440-164-0x000002293FFF0000-0x0000022940000000-memory.dmp

Download

memory/1440-130-0x00007FF8C8AF0000-0x00007FF8C94DC000-memory.dmp

Download

memory/2076-223-0x0000000015740000-0x0000000015C3C000-memory.dmp

Download

memory/2076-119-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2076-120-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4300-17-0x0000013F48D40000-0x0000013F48D50000-memory.dmp

Download

memory/4300-97-0x0000013F48D40000-0x0000013F48D50000-memory.dmp

Download

memory/4300-15-0x0000013F48D40000-0x0000013F48D50000-memory.dmp

Download

memory/4300-103-0x00007FF8C8AF0000-0x00007FF8C94DC000-memory.dmp

Download

memory/4300-52-0x0000013F48D40000-0x0000013F48D50000-memory.dmp

Download

memory/4300-18-0x00007FF8C8AF0000-0x00007FF8C94DC000-memory.dmp

Download

memory/4324-105-0x000001E748DA0000-0x000001E748DB0000-memory.dmp

Download

memory/4324-23-0x000001E748EB0000-0x000001E748F26000-memory.dmp

Download

memory/4324-49-0x000001E748DA0000-0x000001E748DB0000-memory.dmp

Download

memory/4324-19-0x000001E748DA0000-0x000001E748DB0000-memory.dmp

Download

memory/4324-16-0x000001E748DA0000-0x000001E748DB0000-memory.dmp

Download

memory/4324-110-0x00007FF8C8AF0000-0x00007FF8C94DC000-memory.dmp

Download

memory/4324-14-0x00007FF8C8AF0000-0x00007FF8C94DC000-memory.dmp

Download

memory/4324-13-0x000001E748CF0000-0x000001E748D12000-memory.dmp

Download