776a6f8c7348c60e0d7981691343d7d47295564b910d653e6318131349fec27a | Triage

Analysis

max time kernel
28s
max time network
32s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
24/04/2024, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

explorer.exe
Size

173KB
MD5

16e7f875c0c72a632a6d215157ecf511
SHA1

91fd9a791aba18469dea94e259f9dafa67f48c14
SHA256

776a6f8c7348c60e0d7981691343d7d47295564b910d653e6318131349fec27a
SHA512

95bc2b431720ca5739b06b96f6a6fb53c609642cba6bf49c4258190888ab1914b52058392b95f546272bf3ebdb8dcad217d6fcd469653f20c7e6dde60e686729
SSDEEP

3072:BubMslbFQLwumPR/VkJqKGnGdsbkuws4bH0hLN2:BElbImIwE+bkuwsYUT

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk	explorer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk	explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe"	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
1448	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	explorer.exe
Token: SeDebugPrivilege	4884	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1448	4884	explorer.exe	80
PID 4884 wrote to memory of 1448	4884	explorer.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\explorer.exe
"C:\Users\Admin\AppData\Local\Temp\explorer.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Local\Temp\explorer.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4884-0-0x0000000000D10000-0x0000000000D40000-memory.dmp

Filesize
192KB

Download
memory/4884-1-0x00007FFDA6590000-0x00007FFDA7052000-memory.dmp

Filesize
10.8MB

Download
memory/4884-3-0x000000001B9F0000-0x000000001BA00000-memory.dmp

Filesize
64KB

Download
memory/4884-4-0x00007FFDA6590000-0x00007FFDA7052000-memory.dmp

Filesize
10.8MB

Download
memory/4884-5-0x000000001B9F0000-0x000000001BA00000-memory.dmp

Filesize
64KB

Download