2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb

General

Target
_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Size 69KB
Sample260621-aa84lsav2j
SHA256 2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb
MD5 486063249f6b355cf0a50e7c2eb76445
SHA1 6d89256296cac304750e190e5650942449929b38
SHA512 beeb4d967d1b200cd506fcb1448119de961bb3c794e7103731722b5257980010e4991d51a45d68383902b0a1652ade393761d1418c5728023fe18d3c3f3f504c
SSDEEP 768:4YlbdXo81wwk+EgORzDZ3M5C0/M1c9GtCw/k5z+JicP27wzdvOfs39bS6rQlld52:HrYS8xinM1WGU+IcP2iYg9bS6Unc8G
TLSH
T13463C7D8367B8831D17F6DFAE6C7624F5EB05133A801D6860CD226E26901A86DD4FCF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe

Executes dropped EXE 17 IoCs

pid	Process
2360	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
3644	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
2688	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
4988	svchost.exe
4372	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
5380	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
5688	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
3168	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
1484	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
4608	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
3452	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
3712	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
3160	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
3428	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
5324	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
5672	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
2552	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe"	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
896	schtasks.exe
5248	schtasks.exe
1540	schtasks.exe
3716	schtasks.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	2360	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	3644	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	2688	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	4372	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	4988	svchost.exe
Token: SeDebugPrivilege	5380	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	5688	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	3168	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	1484	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	4608	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	3452	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	3712	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	3160	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	3428	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	5324	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	5672	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Token: SeDebugPrivilege	2552	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 896	4980	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe	88
PID 4980 wrote to memory of 5248	4980	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe	90
PID 4980 wrote to memory of 1540	4980	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe	92
PID 4980 wrote to memory of 3716	4980	_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
"C:\Users\Admin\AppData\Local\Temp\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /sc minute /mo 1 /tn "WhatsAppUpdate" /tr "C:\Users\Admin\AppData\Roaming\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:896
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /sc minute /mo 1 /tn "TeamViewerUpdate" /tr "C:\Users\Admin\AppData\Local\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5248
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /sc minute /mo 1 /tn "DiscordUpdate" /tr "C:\ProgramData\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1540
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /sc minute /mo 1 /tn "OneDriveSync" /tr "C:\Windows\Temp\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3716

C:\Users\Admin\AppData\Local\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
C:\Users\Admin\AppData\Local\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\Temp\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
C:\Windows\Temp\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3644

C:\Users\Admin\AppData\Roaming\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
C:\Users\Admin\AppData\Roaming\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\ProgramData\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
C:\ProgramData\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Users\Admin\AppData\Roaming\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
"C:\Users\Admin\AppData\Roaming\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5380

C:\Users\Admin\AppData\Local\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
"C:\Users\Admin\AppData\Local\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5688

C:\ProgramData\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
"C:\ProgramData\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Windows\Temp\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
"C:\Windows\Temp\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Users\Admin\AppData\Roaming\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
"C:\Users\Admin\AppData\Roaming\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Users\Admin\AppData\Local\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
"C:\Users\Admin\AppData\Local\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\ProgramData\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
"C:\ProgramData\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Windows\Temp\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
"C:\Windows\Temp\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Users\Admin\AppData\Roaming\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
"C:\Users\Admin\AppData\Roaming\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3428

C:\Users\Admin\AppData\Local\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
"C:\Users\Admin\AppData\Local\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5324

C:\ProgramData\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
"C:\ProgramData\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5672

C:\Windows\Temp\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
"C:\Windows\Temp\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe

Path C:\Users\Admin\AppData\Local\_2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb.exe
Size 69KB
SHA256 2bf04b9a583e6f1efa661a43d357bc8ea143bcb53fa87f81081347ee2feb80eb
MD5 486063249f6b355cf0a50e7c2eb76445
SHA1 6d89256296cac304750e190e5650942449929b38
SHA512 beeb4d967d1b200cd506fcb1448119de961bb3c794e7103731722b5257980010e4991d51a45d68383902b0a1652ade393761d1418c5728023fe18d3c3f3f504c
SSDEEP 768:4YlbdXo81wwk+EgORzDZ3M5C0/M1c9GtCw/k5z+JicP27wzdvOfs39bS6rQlld52:HrYS8xinM1WGU+IcP2iYg9bS6Unc8G
TLSH
T13463C7D8367B8831D17F6DFAE6C7624F5EB05133A801D6860CD226E26901A86DD4FCF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4980-0-0x00007FFBA283F000-0x00007FFBA2840000-memory.dmp

Download

memory/4980-1-0x0000000000C20000-0x0000000000C38000-memory.dmp

Download

memory/4980-2-0x00007FFBA26B0000-0x00007FFBA3054000-memory.dmp

Download

memory/4980-3-0x00007FFBA26B0000-0x00007FFBA3054000-memory.dmp

Download

memory/4980-4-0x00007FFBA26B0000-0x00007FFBA3054000-memory.dmp

Download

memory/4980-5-0x00007FFBA26B0000-0x00007FFBA3054000-memory.dmp

Download

memory/4980-6-0x00007FFBA26B0000-0x00007FFBA3054000-memory.dmp

Download

memory/4980-7-0x00007FFBA26B0000-0x00007FFBA3054000-memory.dmp

Download

memory/4980-13-0x00007FFBA26B0000-0x00007FFBA3054000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads