e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c

Resubmissions

17/04/2024, 12:24

240417-pljenaef838

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

16/04/2024, 14:05

Analysis

max time kernel
148s
max time network
151s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
17/04/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
Size 5.3MB
Sample240417-plcbcaef68
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5012	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File opened for modification	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4352	powershell.exe
1788	powershell.exe
1788	powershell.exe
4352	powershell.exe
1788	powershell.exe
4352	powershell.exe
4196	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
4196	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
2752	powershell.exe
1392	powershell.exe
1392	powershell.exe
2752	powershell.exe
2752	powershell.exe
1392	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeIncreaseQuotaPrivilege	4352	powershell.exe
Token: SeSecurityPrivilege	4352	powershell.exe
Token: SeTakeOwnershipPrivilege	4352	powershell.exe
Token: SeLoadDriverPrivilege	4352	powershell.exe
Token: SeSystemProfilePrivilege	4352	powershell.exe
Token: SeSystemtimePrivilege	4352	powershell.exe
Token: SeProfSingleProcessPrivilege	4352	powershell.exe
Token: SeIncBasePriorityPrivilege	4352	powershell.exe
Token: SeCreatePagefilePrivilege	4352	powershell.exe
Token: SeBackupPrivilege	4352	powershell.exe
Token: SeRestorePrivilege	4352	powershell.exe
Token: SeShutdownPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeSystemEnvironmentPrivilege	4352	powershell.exe
Token: SeRemoteShutdownPrivilege	4352	powershell.exe
Token: SeUndockPrivilege	4352	powershell.exe
Token: SeManageVolumePrivilege	4352	powershell.exe
Token: 33	4352	powershell.exe
Token: 34	4352	powershell.exe
Token: 35	4352	powershell.exe
Token: 36	4352	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeIncreaseQuotaPrivilege	2752	powershell.exe
Token: SeSecurityPrivilege	2752	powershell.exe
Token: SeTakeOwnershipPrivilege	2752	powershell.exe
Token: SeLoadDriverPrivilege	2752	powershell.exe
Token: SeSystemProfilePrivilege	2752	powershell.exe
Token: SeSystemtimePrivilege	2752	powershell.exe
Token: SeProfSingleProcessPrivilege	2752	powershell.exe
Token: SeIncBasePriorityPrivilege	2752	powershell.exe
Token: SeCreatePagefilePrivilege	2752	powershell.exe
Token: SeBackupPrivilege	2752	powershell.exe
Token: SeRestorePrivilege	2752	powershell.exe
Token: SeShutdownPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeSystemEnvironmentPrivilege	2752	powershell.exe
Token: SeRemoteShutdownPrivilege	2752	powershell.exe
Token: SeUndockPrivilege	2752	powershell.exe
Token: SeManageVolumePrivilege	2752	powershell.exe
Token: 33	2752	powershell.exe
Token: 34	2752	powershell.exe
Token: 35	2752	powershell.exe
Token: 36	2752	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4352	4196	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	72
PID 4196 wrote to memory of 4352	4196	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	72
PID 4196 wrote to memory of 1788	4196	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	74
PID 4196 wrote to memory of 1788	4196	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	74
PID 4196 wrote to memory of 4520	4196	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	77
PID 4196 wrote to memory of 4520	4196	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	77
PID 4196 wrote to memory of 5012	4196	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	79
PID 4196 wrote to memory of 5012	4196	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	79
PID 5012 wrote to memory of 2752	5012	svchost.exe	81
PID 5012 wrote to memory of 2752	5012	svchost.exe	81
PID 5012 wrote to memory of 1392	5012	svchost.exe	83
PID 5012 wrote to memory of 1392	5012	svchost.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
"C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:4520
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 7643d492a6f1e035b63b2e16c9c21d974a77dfd2d8e90b9c15ee412625e88c4c
MD5 268b890dae39e430e8b127909067ed96
SHA1 35939515965c0693ef46e021254c3e73ea8c4a2b
SHA512 abc4b2ce10a6566f38c00ad55e433791dd45fca47deec70178daf0763578ff019fb0ec70792d5e9ecde4eb6778a35ba8a8c7ecd07550597d9bbb13521c9b98fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6320ac5f5bd42a4d2b7e527aa54f7c76b996f4ddd6e41ef307c2aaf0769d8e21
MD5 e869c5dc5a599d23a0039c545de695f9
SHA1 b4fe398c90ffd42d444d0bd3bcd47b877ba1110e
SHA512 fc4e20995058a78b1f3582041c7cc7578b4a6c979e82a3d0e161477649e533a3627b46825d2f386dabfbc5e3e5851b8826ffdb767a30f2d807c8692c90faa574
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3f87bbf870f708e725f9960f004f8c6be2041d5bad8b268dda5107eb36022fe4
MD5 647a899c53d4087e41fd0ced27237549
SHA1 522a28ec9e316002af72005cab1969904bcf19a7
SHA512 68b02e092d9f46b6f598436e3a81f608ee9f965911e73e89523e473de368773149a1cdadc1acfb8fc4005d55c9dd9a318c0aa15e5b63f19f8c91d140183daf01
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_aodfbuqu.tf1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aodfbuqu.tf1.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.6MB
SHA256 b8ac5707fb24e123ee2bb53e97cfb166b3e86f1ee46b36bef7c41cf0f58047fd
MD5 8c29dca81612f559ac2e9aa5012896e4
SHA1 e7b504c8be6ae987ced54380dc2a34d03c613ef7
SHA512 7c910b5c97dc3f556d35c9b48dd5ea4c4b55827bb66b508347c63650ad744f3992280df808a187f06daede1895347c46787fd110ba2015f92a927ab1f650a98c
SSDEEP 12288:KhhhTnI3fHDnNkbO4uwpzjCHTWb0NF0R3CobPNJUSXg6YUSnQ5s:KEHjyr1QS0WzNBwQX5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 7.2MB
SHA256 f1efbf286b84203c08b5f817681a3104cf9c9d5787d2eae55eb0bb513de32108
MD5 a4e77fb505dbfdc025f9948defb8f3db
SHA1 4cafb3206cad193b5da6801af8635d06507e74af
SHA512 c1cd10872ca6228d6d4dde6cabca16839fd3d78b270ff5afd9e8bbffc03eb23d1d1a5f352836f3a31f9e778fbf65c20c6e743ac526d7f91d43ad93753e899e86
SSDEEP 24576:jAXENoWZJI51PeomccYYL+QPmkL8YPTMq5/Fn7u2lRFA6yjXzW8uSeUbjQ9bw3e8:Xg8eTAJjb5y
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 5.3MB
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1392-165-0x000002160F1E0000-0x000002160F1F0000-memory.dmp

Download

memory/1392-132-0x000002160F1E0000-0x000002160F1F0000-memory.dmp

Download

memory/1392-128-0x00007FFF9ADA0000-0x00007FFF9B78C000-memory.dmp

Download

memory/1392-133-0x000002160F1E0000-0x000002160F1F0000-memory.dmp

Download

memory/1392-213-0x000002160F1E0000-0x000002160F1F0000-memory.dmp

Download

memory/1392-220-0x00007FFF9ADA0000-0x00007FFF9B78C000-memory.dmp

Download

memory/1788-108-0x00007FFF9ADA0000-0x00007FFF9B78C000-memory.dmp

Download

memory/1788-17-0x0000023C189F0000-0x0000023C18A00000-memory.dmp

Download

memory/1788-97-0x0000023C189F0000-0x0000023C18A00000-memory.dmp

Download

memory/1788-51-0x0000023C189F0000-0x0000023C18A00000-memory.dmp

Download

memory/1788-11-0x00007FFF9ADA0000-0x00007FFF9B78C000-memory.dmp

Download

memory/1788-15-0x0000023C189F0000-0x0000023C18A00000-memory.dmp

Download

memory/2752-163-0x0000021BD7DB0000-0x0000021BD7DC0000-memory.dmp

Download

memory/2752-221-0x00007FFF9ADA0000-0x00007FFF9B78C000-memory.dmp

Download

memory/2752-122-0x00007FFF9ADA0000-0x00007FFF9B78C000-memory.dmp

Download

memory/2752-214-0x0000021BD7DB0000-0x0000021BD7DC0000-memory.dmp

Download

memory/2752-130-0x0000021BD7DB0000-0x0000021BD7DC0000-memory.dmp

Download

memory/2752-129-0x0000021BD7DB0000-0x0000021BD7DC0000-memory.dmp

Download

memory/4196-0-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4196-1-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4196-115-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4196-2-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4196-3-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4352-16-0x0000028CF5050000-0x0000028CF5060000-memory.dmp

Download

memory/4352-107-0x00007FFF9ADA0000-0x00007FFF9B78C000-memory.dmp

Download

memory/4352-48-0x0000028CF5050000-0x0000028CF5060000-memory.dmp

Download

memory/4352-13-0x0000028CF5050000-0x0000028CF5060000-memory.dmp

Download

memory/4352-106-0x0000028CF5050000-0x0000028CF5060000-memory.dmp

Download

memory/4352-9-0x00007FFF9ADA0000-0x00007FFF9B78C000-memory.dmp

Download

memory/4352-23-0x0000028CF5310000-0x0000028CF5386000-memory.dmp

Download

memory/4352-116-0x0000028CF5050000-0x0000028CF5060000-memory.dmp

Download

memory/4352-18-0x0000028CF5160000-0x0000028CF5182000-memory.dmp

Download

memory/5012-119-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/5012-222-0x0000000015540000-0x0000000015A3C000-memory.dmp

Download