667cb510540d8e7a6cd30007d30a8ca11110dde57bd03d2cbf87ca6b7868bdb9

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef1a8eac84dd9ea2c994351a14b9c6811260e765cb992411c3e4ace9ce289b30.exe
Size

545KB
MD5

c6d7786cb9e334f730ba4fb984b43bf0
SHA1

f67a77aaea6bfc19766500c2100b2aa3d449c328
SHA256

ef1a8eac84dd9ea2c994351a14b9c6811260e765cb992411c3e4ace9ce289b30
SHA512

a536128a1ed94efb3e864769a70f0e4786a97c15aab9f8eae431066d783a3e58453fe0bb0cf5bb52586d2a0d2034005771e286d57bd92b5866077d9e26f9d4a6
SSDEEP

12288:PKx6YNxBRA0L1jKwXmsykcJlKRrbW4r2GNnqOs/fKSd/XNKN5A+:E6ERA0Low2TkKlmbW4lNnq7/V85

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
8152	powershell.exe
7928	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1824	AccessControlType.exe

Loads dropped DLL 1 IoCs

pid	Process
8168	taskeng.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
7928	powershell.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
1824	AccessControlType.exe
8152	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	ef1a8eac84dd9ea2c994351a14b9c6811260e765cb992411c3e4ace9ce289b30.exe
Token: SeDebugPrivilege	7928	powershell.exe
Token: SeDebugPrivilege	1824	AccessControlType.exe
Token: SeDebugPrivilege	8152	powershell.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 7896 wrote to memory of 7928	7896	taskeng.exe	34
PID 7896 wrote to memory of 7928	7896	taskeng.exe	34
PID 7896 wrote to memory of 7928	7896	taskeng.exe	34
PID 8168 wrote to memory of 1824	8168	taskeng.exe	37
PID 8168 wrote to memory of 1824	8168	taskeng.exe	37
PID 8168 wrote to memory of 1824	8168	taskeng.exe	37
PID 1824 wrote to memory of 1576	1824	AccessControlType.exe	38
PID 1824 wrote to memory of 1576	1824	AccessControlType.exe	38
PID 1824 wrote to memory of 1576	1824	AccessControlType.exe	38
PID 1824 wrote to memory of 8064	1824	AccessControlType.exe	39
PID 1824 wrote to memory of 8064	1824	AccessControlType.exe	39
PID 1824 wrote to memory of 8064	1824	AccessControlType.exe	39
PID 1824 wrote to memory of 8068	1824	AccessControlType.exe	40
PID 1824 wrote to memory of 8068	1824	AccessControlType.exe	40
PID 1824 wrote to memory of 8068	1824	AccessControlType.exe	40
PID 1824 wrote to memory of 8076	1824	AccessControlType.exe	41
PID 1824 wrote to memory of 8076	1824	AccessControlType.exe	41
PID 1824 wrote to memory of 8076	1824	AccessControlType.exe	41
PID 1824 wrote to memory of 8084	1824	AccessControlType.exe	42
PID 1824 wrote to memory of 8084	1824	AccessControlType.exe	42
PID 1824 wrote to memory of 8084	1824	AccessControlType.exe	42
PID 1824 wrote to memory of 8104	1824	AccessControlType.exe	43
PID 1824 wrote to memory of 8104	1824	AccessControlType.exe	43
PID 1824 wrote to memory of 8104	1824	AccessControlType.exe	43
PID 1824 wrote to memory of 8112	1824	AccessControlType.exe	44
PID 1824 wrote to memory of 8112	1824	AccessControlType.exe	44
PID 1824 wrote to memory of 8112	1824	AccessControlType.exe	44
PID 1824 wrote to memory of 8124	1824	AccessControlType.exe	45
PID 1824 wrote to memory of 8124	1824	AccessControlType.exe	45
PID 1824 wrote to memory of 8124	1824	AccessControlType.exe	45
PID 1824 wrote to memory of 8128	1824	AccessControlType.exe	46
PID 1824 wrote to memory of 8128	1824	AccessControlType.exe	46
PID 1824 wrote to memory of 8128	1824	AccessControlType.exe	46
PID 1824 wrote to memory of 8132	1824	AccessControlType.exe	47
PID 1824 wrote to memory of 8132	1824	AccessControlType.exe	47
PID 1824 wrote to memory of 8132	1824	AccessControlType.exe	47
PID 7896 wrote to memory of 8152	7896	taskeng.exe	48
PID 7896 wrote to memory of 8152	7896	taskeng.exe	48
PID 7896 wrote to memory of 8152	7896	taskeng.exe	48

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ef1a8eac84dd9ea2c994351a14b9c6811260e765cb992411c3e4ace9ce289b30.exe
"C:\Users\Admin\AppData\Local\Temp\ef1a8eac84dd9ea2c994351a14b9c6811260e765cb992411c3e4ace9ce289b30.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Windows\system32\taskeng.exe
taskeng.exe {EB2F1A00-5B9E-4E84-A92F-F45D90E4A5A6} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:S4U:
1⤵
- Suspicious use of WriteProcessMemory
PID:7896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQQBjAGMAZQBzAHMAQwBvAG4AdAByAG8AbABUAHkAcABlAC4AZQB4AGUAOwA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQQBjAGMAZQBzAHMAQwBvAG4AdAByAG8AbABUAHkAcABlAC4AZQB4AGUAOwA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:8152

C:\Windows\system32\taskeng.exe
taskeng.exe {766BC5FE-9C3C-4A0F-AB4E-2D264B8C9E4F} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:8168
- C:\Users\Admin\AppData\Local\LCID\tjnduz\AccessControlType.exe
  C:\Users\Admin\AppData\Local\LCID\tjnduz\AccessControlType.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    3⤵
    PID:1576
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    3⤵
    PID:8064
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    3⤵
    PID:8068
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    3⤵
    PID:8076
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    3⤵
    PID:8084
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    3⤵
    PID:8104
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    3⤵
    PID:8112
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    3⤵
    PID:8124
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    3⤵
    PID:8128
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    3⤵
    PID:8132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\LCID\tjnduz\AccessControlType.exe

Filesize
545KB

MD5
c6d7786cb9e334f730ba4fb984b43bf0

SHA1
f67a77aaea6bfc19766500c2100b2aa3d449c328

SHA256
ef1a8eac84dd9ea2c994351a14b9c6811260e765cb992411c3e4ace9ce289b30

SHA512
a536128a1ed94efb3e864769a70f0e4786a97c15aab9f8eae431066d783a3e58453fe0bb0cf5bb52586d2a0d2034005771e286d57bd92b5866077d9e26f9d4a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4VOS6VCOMSHNTMSPV9FL.temp

Filesize
7KB

MD5
55e7f1ab0fe40ef1f2da787090417cf4

SHA1
f9f5d9e63658f0cbad7776057ab4c44c1b2f2e31

SHA256
8500418e229873a1bf259aa143b2ec432af59c7d8323e4bbc02f9b03122d986a

SHA512
00509aa3b8f6521686942394e37d29a51a4b8ef01d334287eccafe066575bca6d1642da1070ea80f5f81473a597c0a6e3ec51f3350a4c9c7ab86eb5e908ed870

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
443fb64576980dc27169e238a0b4d526

SHA1
7c603108ebbd5a8a5812e4e073ac2a7b82619c10

SHA256
86c894d474e4cc1801dd5495642b25d93c38d4f40424a1e34e48c7861fd3b569

SHA512
583501d16dd202db345dd11e211357b75314568533b830909470df113c325e15356ca518b4e4021fcb4450afd1e4c7ed976f0803df7a368661f94476fb6312be

Download Submit
memory/1824-1908-0x0000000000F60000-0x0000000000FEC000-memory.dmp

Filesize
560KB

Download
memory/2532-25-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-63-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-2-0x0000000000DD0000-0x0000000000E98000-memory.dmp

Filesize
800KB

Download
memory/2532-3-0x000007FEF5410000-0x000007FEF5DFC000-memory.dmp

Filesize
9.9MB

Download
memory/2532-4-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-7-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-54-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-59-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-67-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-21-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-23-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-61-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-51-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-49-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-45-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-43-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-41-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-39-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-37-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-35-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-29-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-27-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-1-0x0000000001190000-0x000000000121C000-memory.dmp

Filesize
560KB

Download
memory/2532-0-0x000007FEF5413000-0x000007FEF5414000-memory.dmp

Filesize
4KB

Download
memory/2532-65-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-19-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-17-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-15-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-13-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-11-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-9-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-57-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-55-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-47-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-33-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-31-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-5-0x0000000000DD0000-0x0000000000E93000-memory.dmp

Filesize
780KB

Download
memory/2532-1891-0x0000000002620000-0x000000000266C000-memory.dmp

Filesize
304KB

Download
memory/2532-1890-0x0000000001130000-0x0000000001186000-memory.dmp

Filesize
344KB

Download
memory/2532-1892-0x0000000002670000-0x00000000026C4000-memory.dmp

Filesize
336KB

Download
memory/2532-1893-0x000007FEF5413000-0x000007FEF5414000-memory.dmp

Filesize
4KB

Download
memory/2532-1898-0x000007FEF5410000-0x000007FEF5DFC000-memory.dmp

Filesize
9.9MB

Download
memory/2532-1903-0x000007FEF5410000-0x000007FEF5DFC000-memory.dmp

Filesize
9.9MB

Download
memory/7928-1899-0x00000000018F0000-0x0000000001970000-memory.dmp

Filesize
512KB

Download
memory/7928-1900-0x000000001A210000-0x000000001A4F2000-memory.dmp

Filesize
2.9MB

Download
memory/7928-1901-0x0000000000AB0000-0x0000000000AB8000-memory.dmp

Filesize
32KB

Download
memory/8152-3801-0x0000000000B20000-0x0000000000B28000-memory.dmp

Filesize
32KB

Download
memory/8152-3800-0x000000001A190000-0x000000001A472000-memory.dmp

Filesize
2.9MB

Download