e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c

Resubmissions

17/04/2024, 12:24

240417-pljenaef838

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

16/04/2024, 14:05

Analysis

max time kernel
299s
max time network
300s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
Size 5.3MB
Sample240417-plfzjaef77
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1456	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2252	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
2252	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File opened for modification	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2660	powershell.exe
2420	powershell.exe
2252	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
268	powershell.exe
600	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	268	powershell.exe
Token: SeDebugPrivilege	600	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2420	2252	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	28
PID 2252 wrote to memory of 2420	2252	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	28
PID 2252 wrote to memory of 2420	2252	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	28
PID 2252 wrote to memory of 2660	2252	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	30
PID 2252 wrote to memory of 2660	2252	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	30
PID 2252 wrote to memory of 2660	2252	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	30
PID 2252 wrote to memory of 1560	2252	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	32
PID 2252 wrote to memory of 1560	2252	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	32
PID 2252 wrote to memory of 1560	2252	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	32
PID 2252 wrote to memory of 1456	2252	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	34
PID 2252 wrote to memory of 1456	2252	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	34
PID 2252 wrote to memory of 1456	2252	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	34
PID 1456 wrote to memory of 268	1456	svchost.exe	37
PID 1456 wrote to memory of 268	1456	svchost.exe	37
PID 1456 wrote to memory of 268	1456	svchost.exe	37
PID 1456 wrote to memory of 600	1456	svchost.exe	39
PID 1456 wrote to memory of 600	1456	svchost.exe	39
PID 1456 wrote to memory of 600	1456	svchost.exe	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
"C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\system32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:1560
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 7288e50c32c4fd5466daff2d74c44c5231e998fcbeb2e5c971664fc54d87873d
MD5 f3f8f61c093b0f8ad3f8ebccf2b6ca91
SHA1 6afa5bfa6e1b4aca182c4f019c37a5e346548b91
SHA512 d1126566897b0af704a3cd8fdb99558388f172182e66b26f0df3480ff1a358086f0c61c1767366b384b6e02b63cf3063ae7822d0e8e3f6f50f1ba85dcc3be9cb
SSDEEP 96:led0PCBM8BdnqvsqvJCwoied0PCBM8BdnqvsEHyqvJCwordPK4JdQHmHH7RPWdXh:800ddUol00ddAHnordP/dLn7RPWdx
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 9a7866decac02ba4f0bac262fab8838d6521670bc748ebb106e8144d478b4d1a
MD5 4e1e43204cd78df40d4300bea0fb60b7
SHA1 4963b5f46b6d70b9d02c8ecf3a609d7f548edba5
SHA512 1b14049801a6f5d2d094c186f764767b40a24697fd43b34d9d1debf3a9de4216efc0f890f8894158b461577ce0226016afa811de96ac8d30a16ee856dbac3e6e
SSDEEP 96:led0PCBM8BdnqvsqvJCwoied0PCBM8BdnqvsEHyqvJCwordPu4JdQHmHH7RPWdXh:800ddUol00ddAHnordPrdLn7RPWdx
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.6MB
SHA256 b8ac5707fb24e123ee2bb53e97cfb166b3e86f1ee46b36bef7c41cf0f58047fd
MD5 8c29dca81612f559ac2e9aa5012896e4
SHA1 e7b504c8be6ae987ced54380dc2a34d03c613ef7
SHA512 7c910b5c97dc3f556d35c9b48dd5ea4c4b55827bb66b508347c63650ad744f3992280df808a187f06daede1895347c46787fd110ba2015f92a927ab1f650a98c
SSDEEP 12288:KhhhTnI3fHDnNkbO4uwpzjCHTWb0NF0R3CobPNJUSXg6YUSnQ5s:KEHjyr1QS0WzNBwQX5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 5.7MB
SHA256 af29a13fe44cd175289b70863d0a68d2dff6a401fe66459c27765c3b79823057
MD5 36487be54079859be5c7311fdacffc2a
SHA1 f0db9681c3e5c62091faa5d75b30aa199b07cdf1
SHA512 1d73e55f57701363c37119228951f83a6c702eec0fedcfb71f5f2a84546ab3848d105fb61fb737c462dab349a1c79c709d90953eed8939178af05d03d75cda1c
SSDEEP 24576:zB3Y8RSsTNPDBIyL6Y6EWCB6jk2goZwJkcHegXx4bgIGKC+7krUhlvQy1XDT7ugM:fvd+VVx9pWBN
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\system\svchost.exe
Size 5.3MB
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/268-79-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Download

memory/268-71-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Download

memory/268-81-0x0000000002EB0000-0x0000000002F30000-memory.dmp

Download

memory/268-62-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Download

memory/268-78-0x0000000002EB4000-0x0000000002EB7000-memory.dmp

Download

memory/268-65-0x00000000022A0000-0x00000000022A8000-memory.dmp

Download

memory/268-61-0x000000001B600000-0x000000001B8E2000-memory.dmp

Download

memory/268-72-0x0000000002EB0000-0x0000000002F30000-memory.dmp

Download

memory/268-70-0x0000000002EB0000-0x0000000002F30000-memory.dmp

Download

memory/600-74-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Download

memory/600-73-0x0000000002D10000-0x0000000002D90000-memory.dmp

Download

memory/600-75-0x0000000002D10000-0x0000000002D90000-memory.dmp

Download

memory/600-76-0x0000000002D10000-0x0000000002D90000-memory.dmp

Download

memory/600-80-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Download

memory/600-77-0x0000000002D10000-0x0000000002D90000-memory.dmp

Download

memory/1456-82-0x000000000B910000-0x000000000BE0C000-memory.dmp

Download

memory/1456-48-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/1456-49-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2252-45-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2252-0-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2252-2-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2252-1-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2252-3-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2420-27-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Download

memory/2420-22-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Download

memory/2420-29-0x0000000002C40000-0x0000000002CC0000-memory.dmp

Download

memory/2420-34-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Download

memory/2420-31-0x0000000002C40000-0x0000000002CC0000-memory.dmp

Download

memory/2420-21-0x000000001B620000-0x000000001B902000-memory.dmp

Download

memory/2420-25-0x0000000002C40000-0x0000000002CC0000-memory.dmp

Download

memory/2420-23-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Download

memory/2660-24-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Download

memory/2660-26-0x00000000029B0000-0x0000000002A30000-memory.dmp

Download

memory/2660-30-0x00000000029B0000-0x0000000002A30000-memory.dmp

Download

memory/2660-32-0x00000000029B0000-0x0000000002A30000-memory.dmp

Download

memory/2660-28-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Download

memory/2660-33-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Download