e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55

General

Target

e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe
Size

716KB
MD5

9647d578b84e06709db03e8763b033d9
SHA1

854dd1d5a7e5f9f832a0b2094c53e9612b588764
SHA256

e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55
SHA512

5da263aa9916b109617e96b6db9c0461f7610984c051bb4b69343165c7f5de500778ccf3bb16fbb28441792b91369a17e67335a8a21fc3c58576cbd906b72186
SSDEEP

12288:7d25fwSsBM/f4NQ5S2PP57BEnQQm3Gv9YnSq3RPUsIXybOnpw7yV8lbKuldpXyqd:7dtwTToQQm21k6sIP7mbKuTObycwGjle

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2624 powershell.exe
2672 powershell.exe

pid	process
2624	powershell.exe
2672	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe

description	pid	process	target process
PID 2248 set thread context of 2528	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2532 2528 WerFault.exe e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2592 schtasks.exe

pid	pid_target	process	target process
2532	2528	WerFault.exe	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe

pid	process
2592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exepowershell.exepowershell.exee224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe

pid	process
2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe
2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe
2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe
2672	powershell.exe
2624	powershell.exe
2528	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exee224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe

description	pid	process	target process
PID 2248 wrote to memory of 2624	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	powershell.exe
PID 2248 wrote to memory of 2624	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	powershell.exe
PID 2248 wrote to memory of 2624	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	powershell.exe
PID 2248 wrote to memory of 2624	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	powershell.exe
PID 2248 wrote to memory of 2672	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	powershell.exe
PID 2248 wrote to memory of 2672	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	powershell.exe
PID 2248 wrote to memory of 2672	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	powershell.exe
PID 2248 wrote to memory of 2672	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	powershell.exe
PID 2248 wrote to memory of 2592	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	schtasks.exe
PID 2248 wrote to memory of 2592	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	schtasks.exe
PID 2248 wrote to memory of 2592	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	schtasks.exe
PID 2248 wrote to memory of 2592	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	schtasks.exe
PID 2248 wrote to memory of 2528	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe
PID 2248 wrote to memory of 2528	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe
PID 2248 wrote to memory of 2528	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe
PID 2248 wrote to memory of 2528	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe
PID 2248 wrote to memory of 2528	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe
PID 2248 wrote to memory of 2528	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe
PID 2248 wrote to memory of 2528	2248	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe
PID 2528 wrote to memory of 2532	2528	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	WerFault.exe
PID 2528 wrote to memory of 2532	2528	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	WerFault.exe
PID 2528 wrote to memory of 2532	2528	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	WerFault.exe
PID 2528 wrote to memory of 2532	2528	e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe
"C:\Users\Admin\AppData\Local\Temp\e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xtkgtig.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xtkgtig" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3830.tmp"
2⤵
- Creates scheduled task(s)
PID:2592

C:\Users\Admin\AppData\Local\Temp\e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe
"C:\Users\Admin\AppData\Local\Temp\e224a25d4418ec2453cb3287fe13416b6a672de61f60341c77271fbb33870a55.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 36
3⤵
- Program crash
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3830.tmp

Filesize
1KB

MD5
75cf296899a711664257af60a1ad5f7e

SHA1
d5cd475475c53b9a0e105ec2b3325b31616130d3

SHA256
75f6dd7d652f30082a3bddf86145bb47265b58601ad03879eaa14399ea01c9f4

SHA512
0efd2280aade9797a65be3262a88d5f918d04813d264fbd59e3f3f9898b82023e107386fa1e24fcdffc64b5735493a41b8fa0b9df0152c8748d804b43f34659c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FG9F32CFC976BG60DH8S.temp

Filesize
7KB

MD5
fb355d101b28897f2b38bfd78a18e082

SHA1
4433eb9784d60e4f6c84be50253395638d45292b

SHA256
f93cd68efd7d7f86e7eaf747221c6429d838db581dd90e798754a6d7d21ea449

SHA512
5d226bb61e1f2460eb21963383b2926338af694b7fb870071bdb6991dc5e06285e88cc094faa3319443e26307de42951bc4b1304c4acd42a4921eb8e3aa9a985

Download Submit
memory/2248-6-0x00000000052F0000-0x000000000537C000-memory.dmp

Filesize
560KB

Download
memory/2248-3-0x0000000004850000-0x00000000048FA000-memory.dmp

Filesize
680KB

Download
memory/2248-4-0x0000000000950000-0x000000000096A000-memory.dmp

Filesize
104KB

Download
memory/2248-5-0x00000000008B0000-0x00000000008C0000-memory.dmp

Filesize
64KB

Download
memory/2248-0-0x000000007414E000-0x000000007414F000-memory.dmp

Filesize
4KB

Download
memory/2248-2-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/2248-1-0x00000000011F0000-0x00000000012A6000-memory.dmp

Filesize
728KB

Download
memory/2248-25-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/2528-24-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2528-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2528-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2528-19-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads