d73a9c06d72b25fc9cc1d3883ba52ba949c91297d20f8cff37481d9b442a7ef7

Analysis

max time kernel
144s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ddd28445b8fc2485cb72f22d1adc936.exe
Size 321KB
Sample240723-pf2daaygnm
SHA256 d73a9c06d72b25fc9cc1d3883ba52ba949c91297d20f8cff37481d9b442a7ef7
MD5 6ddd28445b8fc2485cb72f22d1adc936
SHA1 403c02d952120aafc6fb659a0ce0b99b1384442c
SHA512 9abc68fab4c2a37f6cf07e2d1d7baccf26da411969b6dca4508776b9f57e3ed228dbc1a50e6dc4784791bdb86423d1f20c0f4d118c20d23951906a14ebd4682b
SSDEEP 6144:QtAiKL0PXm/Kn0xv40x+do+iDtLEX/s7fwOCkUECtSZZZZ56:9nYPIOM1+y+6QX/Af0ke
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2936	servisis.exe
1240	servisis.exe
2040	servisis.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2796-0-0x0000000000400000-0x00000000004BC000-memory.dmp	upx
behavioral1/memory/2796-5-0x0000000000400000-0x00000000004BC000-memory.dmp	upx
behavioral1/files/0x0008000000018b54-7.dat	upx
behavioral1/memory/2936-10-0x0000000000400000-0x00000000004BC000-memory.dmp	upx
behavioral1/memory/1240-18-0x0000000000400000-0x00000000004BC000-memory.dmp	upx
behavioral1/memory/2040-28-0x0000000000400000-0x00000000004BC000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2796	6ddd28445b8fc2485cb72f22d1adc936.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 1664	2796	6ddd28445b8fc2485cb72f22d1adc936.exe	29
PID 2796 wrote to memory of 1664	2796	6ddd28445b8fc2485cb72f22d1adc936.exe	29
PID 2796 wrote to memory of 1664	2796	6ddd28445b8fc2485cb72f22d1adc936.exe	29
PID 2796 wrote to memory of 1664	2796	6ddd28445b8fc2485cb72f22d1adc936.exe	29
PID 2876 wrote to memory of 2936	2876	taskeng.exe	32
PID 2876 wrote to memory of 2936	2876	taskeng.exe	32
PID 2876 wrote to memory of 2936	2876	taskeng.exe	32
PID 2876 wrote to memory of 2936	2876	taskeng.exe	32
PID 2876 wrote to memory of 1240	2876	taskeng.exe	33
PID 2876 wrote to memory of 1240	2876	taskeng.exe	33
PID 2876 wrote to memory of 1240	2876	taskeng.exe	33
PID 2876 wrote to memory of 1240	2876	taskeng.exe	33
PID 2876 wrote to memory of 2040	2876	taskeng.exe	34
PID 2876 wrote to memory of 2040	2876	taskeng.exe	34
PID 2876 wrote to memory of 2040	2876	taskeng.exe	34
PID 2876 wrote to memory of 2040	2876	taskeng.exe	34

C:\Users\Admin\AppData\Local\Temp\6ddd28445b8fc2485cb72f22d1adc936.exe
"C:\Users\Admin\AppData\Local\Temp\6ddd28445b8fc2485cb72f22d1adc936.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Roaming\WinZIP_32\version.xml" /tn WPDR\Config_Error\Version /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1664

C:\Windows\system32\taskeng.exe
taskeng.exe {FEC35695-139E-44B7-A8C5-636527E2801B} S-1-5-21-2212144002-1172735686-1556890956-1000:MVFYZPLM\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Roaming\WinZIP_32\servisis.exe
  C:\Users\Admin\AppData\Roaming\WinZIP_32\servisis.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Users\Admin\AppData\Roaming\WinZIP_32\servisis.exe
  C:\Users\Admin\AppData\Roaming\WinZIP_32\servisis.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Users\Admin\AppData\Roaming\WinZIP_32\servisis.exe
  C:\Users\Admin\AppData\Roaming\WinZIP_32\servisis.exe
  2⤵
  - Executes dropped EXE
  PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

servisis.exe

Path C:\Users\Admin\AppData\Roaming\WinZIP_32\servisis.exe
Size 321KB
SHA256 d73a9c06d72b25fc9cc1d3883ba52ba949c91297d20f8cff37481d9b442a7ef7
MD5 6ddd28445b8fc2485cb72f22d1adc936
SHA1 403c02d952120aafc6fb659a0ce0b99b1384442c
SHA512 9abc68fab4c2a37f6cf07e2d1d7baccf26da411969b6dca4508776b9f57e3ed228dbc1a50e6dc4784791bdb86423d1f20c0f4d118c20d23951906a14ebd4682b
SSDEEP 6144:QtAiKL0PXm/Kn0xv40x+do+iDtLEX/s7fwOCkUECtSZZZZ56:9nYPIOM1+y+6QX/Af0ke
MD5 SHA1 SHA512 SSDEEP

Submit Download

version.xml

Path C:\Users\Admin\AppData\Roaming\WinZIP_32\version.xml
Size 1KB
SHA256 93e469a8135addc4822f19a7afb7d02baea8242626188ce3e2b039862fc67511
MD5 2b29aa25ee90747f05e920706e4dfc4f
SHA1 2ec04aa0574178e5b5245362fdb5b1cfbf4ec637
SHA512 2a3f6bda5c957eed82b5fdf39bb33d109c68e39a1e096c944bfe725f027757efa87bc44ea037f9baf47426d0335a12639ff67c626aec3fc1c5c430b2efbf44fb
MD5 SHA1 SHA512

Submit Download

memory/1240-18-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/1240-19-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/2040-28-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/2796-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/2796-1-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2796-5-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/2936-9-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2936-10-0x0000000000400000-0x00000000004BC000-memory.dmp

Download