e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c

Resubmissions

17/04/2024, 12:24

240417-pljenaef838

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

16/04/2024, 14:05

Analysis

max time kernel
134s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
Size 5.3MB
Sample240417-plcbcaef68
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2804	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1736	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
1736	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File opened for modification	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2508	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2648	powershell.exe
2560	powershell.exe
1736	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
788	powershell.exe
1004	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	788	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2560	1736	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	28
PID 1736 wrote to memory of 2560	1736	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	28
PID 1736 wrote to memory of 2560	1736	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	28
PID 1736 wrote to memory of 2648	1736	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	30
PID 1736 wrote to memory of 2648	1736	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	30
PID 1736 wrote to memory of 2648	1736	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	30
PID 1736 wrote to memory of 2508	1736	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	34
PID 1736 wrote to memory of 2508	1736	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	34
PID 1736 wrote to memory of 2508	1736	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	34
PID 1736 wrote to memory of 2804	1736	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	36
PID 1736 wrote to memory of 2804	1736	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	36
PID 1736 wrote to memory of 2804	1736	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	36
PID 2804 wrote to memory of 788	2804	svchost.exe	37
PID 2804 wrote to memory of 788	2804	svchost.exe	37
PID 2804 wrote to memory of 788	2804	svchost.exe	37
PID 2804 wrote to memory of 1004	2804	svchost.exe	39
PID 2804 wrote to memory of 1004	2804	svchost.exe	39
PID 2804 wrote to memory of 1004	2804	svchost.exe	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
"C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- C:\Windows\system32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:2508
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 661631bb054517773ab2ad633977f11eaed67e3b5c0fd3fc31610af42e6519c7
MD5 e4ffcbcaca68e0458e2adc8b57612963
SHA1 58760f046b67fcf1c088575a00a204d0521c4509
SHA512 fb287d9966c8987203649aadc9a31704ceae25b2ad1e71d92d8d22dbbefb93654b08d58e11375cd9040c6954d804a651c5640e00a5312065293cfd02dfe9aae9
SSDEEP 96:nAJaCVM8InqvsqvJCwoq9C3AJaCVM8InqvsEHyqvJCworQ9C7trfQH5Tx7SCXlU7:nAfUUoQC3AfUAHnoryC7lAx7SCuJJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 9368a7b859823efd8d591d7c72288c3a97cc6b010b37eed5ec0cd407643c38a8
MD5 5c5efa1429ad5fa6860d2146bae638dc
SHA1 474a52da2e045b7b5696db3122182a4a4bfe15c8
SHA512 fc99fee1f6eb5d420f9ce5220b50b60a81f8be872e9bb7b4370f43e8439f5a56617f8f32785ea7c7dd7cbf273c579dc961228cc78f5c8e96fd063b99d3a8a379
SSDEEP 96:nAJaCVM8InqvsqvJCwoq9C3AJaCVM8InqvsEHyqvJCworQ9C7NrfQH5Tx7SCXlU7:nAfUUoQC3AfUAHnoryC7FAx7SCuJJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.6MB
SHA256 b8ac5707fb24e123ee2bb53e97cfb166b3e86f1ee46b36bef7c41cf0f58047fd
MD5 8c29dca81612f559ac2e9aa5012896e4
SHA1 e7b504c8be6ae987ced54380dc2a34d03c613ef7
SHA512 7c910b5c97dc3f556d35c9b48dd5ea4c4b55827bb66b508347c63650ad744f3992280df808a187f06daede1895347c46787fd110ba2015f92a927ab1f650a98c
SSDEEP 12288:KhhhTnI3fHDnNkbO4uwpzjCHTWb0NF0R3CobPNJUSXg6YUSnQ5s:KEHjyr1QS0WzNBwQX5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 6.5MB
SHA256 8cab380f5165066d8c3c68f9f1c23fcc21e9210906d7db943585d506d9865c80
MD5 f87981c6884e0d676356ab9fe2370478
SHA1 94f4ca620e65a02364d4cd736936945caf3d928b
SHA512 ea4e1b348585c662225c43ff36a3fcd9b1fbfa334c945393aa1dc71de6ea59a35c5c67451102aef1bc5840f6cde50d4a458738f427a13bab0932e095072d71e4
SSDEEP 24576:TfrPQ9mBLFYGUWl5khqQuerg0sTAhs9Kfe55be/dhGMncrUeV9bAhneyboWrhP1e:rrer9pWhOFg
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \Windows\system\svchost.exe
Size 5.3MB
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/788-50-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

Download

memory/788-55-0x0000000002490000-0x0000000002498000-memory.dmp

Download

memory/788-58-0x00000000025B0000-0x0000000002630000-memory.dmp

Download

memory/788-57-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

Download

memory/788-56-0x00000000025B0000-0x0000000002630000-memory.dmp

Download

memory/788-63-0x00000000025B4000-0x00000000025B7000-memory.dmp

Download

memory/788-49-0x000000001B230000-0x000000001B512000-memory.dmp

Download

memory/788-66-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

Download

memory/788-67-0x00000000025B0000-0x0000000002630000-memory.dmp

Download

memory/1004-64-0x0000000002280000-0x0000000002300000-memory.dmp

Download

memory/1004-68-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

Download

memory/1004-62-0x0000000002280000-0x0000000002300000-memory.dmp

Download

memory/1004-61-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

Download

memory/1004-60-0x0000000002280000-0x0000000002300000-memory.dmp

Download

memory/1004-59-0x000007FEF5DA0000-0x000007FEF673D000-memory.dmp

Download

memory/1004-65-0x0000000002280000-0x0000000002300000-memory.dmp

Download

memory/1736-1-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/1736-4-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/1736-0-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/1736-2-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/1736-37-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/1736-3-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2560-23-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/2560-18-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/2560-14-0x000000001B300000-0x000000001B5E2000-memory.dmp

Download

memory/2560-17-0x0000000002A80000-0x0000000002B00000-memory.dmp

Download

memory/2560-16-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/2560-26-0x0000000002A8B000-0x0000000002AF2000-memory.dmp

Download

memory/2560-25-0x0000000002A80000-0x0000000002B00000-memory.dmp

Download

memory/2648-19-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Download

memory/2648-24-0x0000000002A6B000-0x0000000002AD2000-memory.dmp

Download

memory/2648-22-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Download

memory/2648-21-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Download

memory/2648-20-0x000007FEF5E40000-0x000007FEF67DD000-memory.dmp

Download

memory/2648-15-0x0000000002490000-0x0000000002498000-memory.dmp

Download

memory/2804-41-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2804-39-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2804-69-0x0000000010000000-0x00000000104FC000-memory.dmp

Download

memory/2804-84-0x0000000140000000-0x0000000140644400-memory.dmp

Download