428834a2c88826dd2770ba1c656ccba83dad842f01c6dc0eedeb9c41d2d9549f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
23/03/2025, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

428834a2c88826dd2770ba1c656ccba83dad842f01c6dc0eedeb9c41d2d9549f.exe
Size

17KB
MD5

99b994e89e27dac2fd968ba504e7548b
SHA1

2cb8dc84a31a973dc0c78e3171e9d56faa41a72f
SHA256

428834a2c88826dd2770ba1c656ccba83dad842f01c6dc0eedeb9c41d2d9549f
SHA512

686ea1daf5f36da2aa4069ddeca43e650252ae11e4e8ec304de96f9c0cbab56c0d70ce02ff937d3f32dafe9953a1c555cb1ed43fc8f536d64041660a5108bd59
SSDEEP

192:LaDFitXkdCaRXz5MvsgzJF7Y9/tuLvzy+bDPDtJZqMeDaRzu6bh+aF9nsVVIP2ed:2DAtXmUhc/tu6+F3Du6bTsVKP1y87q92

Score

1^/10

Malware Config

Signatures

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2808	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	428834a2c88826dd2770ba1c656ccba83dad842f01c6dc0eedeb9c41d2d9549f.exe
Token: SeDebugPrivilege	2780	428834a2c88826dd2770ba1c656ccba83dad842f01c6dc0eedeb9c41d2d9549f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2808	1684	428834a2c88826dd2770ba1c656ccba83dad842f01c6dc0eedeb9c41d2d9549f.exe	31
PID 1684 wrote to memory of 2808	1684	428834a2c88826dd2770ba1c656ccba83dad842f01c6dc0eedeb9c41d2d9549f.exe	31
PID 1684 wrote to memory of 2808	1684	428834a2c88826dd2770ba1c656ccba83dad842f01c6dc0eedeb9c41d2d9549f.exe	31
PID 2832 wrote to memory of 2780	2832	taskeng.exe	34
PID 2832 wrote to memory of 2780	2832	taskeng.exe	34
PID 2832 wrote to memory of 2780	2832	taskeng.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\428834a2c88826dd2770ba1c656ccba83dad842f01c6dc0eedeb9c41d2d9549f.exe
"C:\Users\Admin\AppData\Local\Temp\428834a2c88826dd2770ba1c656ccba83dad842f01c6dc0eedeb9c41d2d9549f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\schtasks.exe
  schtasks /create /sc minute /mo 1 /tn "Hot" /tr "C:\Users\Admin\AppData\Local\Temp\428834a2c88826dd2770ba1c656ccba83dad842f01c6dc0eedeb9c41d2d9549f.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2808

C:\Windows\system32\taskeng.exe
taskeng.exe {A1C381B6-A2A7-4DC4-A15B-D72679A8D12E} S-1-5-21-677481364-2238709445-1347953534-1000:JXXXDSWS\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Users\Admin\AppData\Local\Temp\428834a2c88826dd2770ba1c656ccba83dad842f01c6dc0eedeb9c41d2d9549f.exe
  C:\Users\Admin\AppData\Local\Temp\428834a2c88826dd2770ba1c656ccba83dad842f01c6dc0eedeb9c41d2d9549f.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-0-0x000007FEF570E000-0x000007FEF570F000-memory.dmp

Filesize
4KB

Download
memory/1684-1-0x000007FEF5450000-0x000007FEF5DED000-memory.dmp

Filesize
9.6MB

Download
memory/1684-2-0x000007FEF5450000-0x000007FEF5DED000-memory.dmp

Filesize
9.6MB

Download
memory/1684-3-0x000007FEF5450000-0x000007FEF5DED000-memory.dmp

Filesize
9.6MB

Download
memory/2780-4-0x000007FEF5450000-0x000007FEF5DED000-memory.dmp

Filesize
9.6MB

Download
memory/2780-5-0x000007FEF5450000-0x000007FEF5DED000-memory.dmp

Filesize
9.6MB

Download
memory/2780-6-0x000007FEF5450000-0x000007FEF5DED000-memory.dmp

Filesize
9.6MB

Download
memory/2780-7-0x000007FEF5450000-0x000007FEF5DED000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads