fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395

General

Target

fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe
Size

2.9MB
MD5

0abd203d9ec724e158734da542e64c70
SHA1

dcccc0e6a914b8ba691927688a8253e971e8f748
SHA256

fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395
SHA512

b3fbed17bf68fffc650a5f61d1e4ebc4b3ae28f6c8e6f87d24d4a7c402ab7bf366b832464859f536edc5490f7216b7717e9fa1fc0cb8371c910f42a10c10f1a2
SSDEEP

49152:8oj1u70WR2bmhesmSozsd1Ou+GxCt9h4aNvmpqy/iWlgC:1MRLhehS/4uutXFNvm0yqWH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
604	powershell.exe

Deletes itself 1 IoCs

pid	Process
2808	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apscit.exe.lnk	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe

Executes dropped EXE 1 IoCs

pid	Process
2788	apscit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2940	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2840	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2788	apscit.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
604	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1172	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe
Token: SeDebugPrivilege	604	powershell.exe
Token: SeDebugPrivilege	2788	apscit.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 604	1172	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	31
PID 1172 wrote to memory of 604	1172	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	31
PID 1172 wrote to memory of 604	1172	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	31
PID 1172 wrote to memory of 2840	1172	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	33
PID 1172 wrote to memory of 2840	1172	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	33
PID 1172 wrote to memory of 2840	1172	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	33
PID 1172 wrote to memory of 2788	1172	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	35
PID 1172 wrote to memory of 2788	1172	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	35
PID 1172 wrote to memory of 2788	1172	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	35
PID 1172 wrote to memory of 2808	1172	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	36
PID 1172 wrote to memory of 2808	1172	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	36
PID 1172 wrote to memory of 2808	1172	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	36
PID 2808 wrote to memory of 2940	2808	cmd.exe	38
PID 2808 wrote to memory of 2940	2808	cmd.exe	38
PID 2808 wrote to memory of 2940	2808	cmd.exe	38

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe
"C:\Users\Admin\AppData\Local\Temp\fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData\ACCApi'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:604
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /create /tn AccSys /tr "C:\ProgramData\ACCApi\apscit.exe" /st 06:39 /du 23:59 /sc daily /ri 1 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2840
- C:\ProgramData\ACCApi\apscit.exe
  "C:\ProgramData\ACCApi\apscit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpE512.tmp.cmd""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\system32\timeout.exe
    timeout 6
    3⤵
    - Delays execution with timeout.exe
    PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ACCApi\apscit.exe

Filesize
3.4MB

MD5
9d979674e6a6dd6efa4e4230e1e31c4a

SHA1
676be73c7c14c9416dc8162d0fca79ec90ece72d

SHA256
db612a20e95b7bf0215684a51e9785bdd6a7ca382608fe16b3e1eb210f8275bd

SHA512
b0d6c43057fbc4bdbed250555131c6faa3f76a2b3f2ed21ddfc3cfb9d0085355c4dec515f66750af447a34313036691511f45bdc8ec1201f9ef0cfa995cc0119

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE512.tmp.cmd

Filesize
217B

MD5
b6f5ac0d2392f6c25c4197ec65c5e7cf

SHA1
5a7aef4ff72a02e3eb6b885c6e23cc6bfd07009d

SHA256
c74cad51a3e5e1cc9065cc919ec2c12aad7aaa79532634c1594e262093f4d72c

SHA512
73f85a5c65f2a0dd2d336e1ba2aaf9cf857900bb7754b6f3be16a1b10ea2d4e5737ad78ec5b3ae659eba5c3005bb1ff1462ca91c90a3114621255e71d1dcf12a

Download Submit
memory/604-10-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/604-23-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/604-24-0x0000000002720000-0x0000000002728000-memory.dmp

Filesize
32KB

Download
memory/1172-0-0x000007FEF59E3000-0x000007FEF59E4000-memory.dmp

Filesize
4KB

Download
memory/1172-1-0x0000000001270000-0x00000000012E8000-memory.dmp

Filesize
480KB

Download
memory/2788-14-0x0000000000F70000-0x0000000000FE8000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads