Analysis
-
max time kernel
205s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 13:36
Static task
static1
Behavioral task
behavioral1
Sample
ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe
Resource
win7-20240221-en
General
-
Target
ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe
-
Size
596KB
-
MD5
31622d9e964f5065f6940c1771ca0940
-
SHA1
a3212dad73b667a3e555cefe22512e22633f7a55
-
SHA256
ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd
-
SHA512
cd7dc9e49b51dce78f75f38a7bb4e7735fd836668d12d92e0ab144462fb95170f926a938bb3b1b8cbee645ddf27f53be03f2f609873c4728dd18292093c62d67
-
SSDEEP
12288:v5E0oN04j4uYuDHppCK1oIG6k7BKkCivD0qkLwPFA:uA4//cZ6kckCwD0Dw
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exepowershell.exepowershell.exepid process 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 580 powershell.exe 1364 powershell.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe Token: SeDebugPrivilege 580 powershell.exe Token: SeDebugPrivilege 1364 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exedescription pid process target process PID 2296 wrote to memory of 580 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe powershell.exe PID 2296 wrote to memory of 580 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe powershell.exe PID 2296 wrote to memory of 580 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe powershell.exe PID 2296 wrote to memory of 1364 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe powershell.exe PID 2296 wrote to memory of 1364 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe powershell.exe PID 2296 wrote to memory of 1364 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe powershell.exe PID 2296 wrote to memory of 2088 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe schtasks.exe PID 2296 wrote to memory of 2088 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe schtasks.exe PID 2296 wrote to memory of 2088 2296 ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe"C:\Users\Admin\AppData\Local\Temp\ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:580 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tLWNXdp.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tLWNXdp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6B22.tmp"2⤵
- Creates scheduled task(s)
PID:2088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6B22.tmpFilesize
1KB
MD5b694b62ad09cc303ddbe614b20935e93
SHA1c0b63ab11869dc79964f415660a7fd5ada197591
SHA256dc62bf68c317462c90284730b6fd88f96cc217721283916116fcb110b284963f
SHA5127ef2fc087a83ac261d501e611833e8229608583c840cbbbab1f87faf2fcaeda67942143eb0a9c316bea152fc958216d2ba1673b1a04b5c495d168ffeafcd23e7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD563e732a96c9c3546f69d2cc3849b2d97
SHA1235213fd843192720848c2fc6a6a2c10e673cddb
SHA256219ebd91f85fba608c3004e47eca2580f86b9955b4f2588301979b954c2393be
SHA51217f3946cf6987ce11f6852898c37c1a27ffb6ca7dfe6c1149fea5de976a8479d470e75c1f22d6e124ee3ce487c2554c457568819365701c1426f2fd2521e5c61
-
memory/580-14-0x0000000002290000-0x0000000002298000-memory.dmpFilesize
32KB
-
memory/580-35-0x000007FEED830000-0x000007FEEE1CD000-memory.dmpFilesize
9.6MB
-
memory/580-18-0x000007FEED830000-0x000007FEEE1CD000-memory.dmpFilesize
9.6MB
-
memory/580-23-0x00000000026E0000-0x0000000002760000-memory.dmpFilesize
512KB
-
memory/580-21-0x000007FEED830000-0x000007FEEE1CD000-memory.dmpFilesize
9.6MB
-
memory/580-22-0x00000000026E0000-0x0000000002760000-memory.dmpFilesize
512KB
-
memory/580-20-0x00000000026E0000-0x0000000002760000-memory.dmpFilesize
512KB
-
memory/580-13-0x000000001B2D0000-0x000000001B5B2000-memory.dmpFilesize
2.9MB
-
memory/1364-30-0x0000000002480000-0x0000000002500000-memory.dmpFilesize
512KB
-
memory/1364-29-0x000007FEED830000-0x000007FEEE1CD000-memory.dmpFilesize
9.6MB
-
memory/1364-36-0x000007FEED830000-0x000007FEEE1CD000-memory.dmpFilesize
9.6MB
-
memory/1364-34-0x0000000002480000-0x0000000002500000-memory.dmpFilesize
512KB
-
memory/1364-32-0x0000000002480000-0x0000000002500000-memory.dmpFilesize
512KB
-
memory/1364-31-0x000007FEED830000-0x000007FEEE1CD000-memory.dmpFilesize
9.6MB
-
memory/2296-5-0x000000001AE70000-0x000000001AEF0000-memory.dmpFilesize
512KB
-
memory/2296-3-0x000000001AE70000-0x000000001AEF0000-memory.dmpFilesize
512KB
-
memory/2296-0-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmpFilesize
9.9MB
-
memory/2296-4-0x0000000000820000-0x000000000083A000-memory.dmpFilesize
104KB
-
memory/2296-2-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmpFilesize
9.9MB
-
memory/2296-8-0x0000000002640000-0x00000000026A0000-memory.dmpFilesize
384KB
-
memory/2296-6-0x0000000000190000-0x00000000001A2000-memory.dmpFilesize
72KB
-
memory/2296-1-0x000000013F370000-0x000000013F408000-memory.dmpFilesize
608KB
-
memory/2296-7-0x0000000000710000-0x0000000000720000-memory.dmpFilesize
64KB