8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283

General

Target
8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283.exe
Size 4.5MB
Sample260721-zankcahn21
SHA256 8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283
MD5 8c82496049dd65950f842b02171b32c0
SHA1 c79f3ffc6e55121710bcb850f3e6e9d20b0eba61
SHA512 ef5695178ec3a70c9e0573670d68d6631454dd87f0780c77ae8a7829524630552178300ad6148995b458723ad2aa18c050053456bc89a1f912e2d7f3ee592627
SSDEEP 98304:Z1DLMVtjANF8oC4xEyrTVYm8bILHGWCv5IjjPmgDfwxfH+YEO:Z1XUWXC4xEXegv5IjjPmgDfOfH7EO
TLSH
T1D4268D43D65291E9C02BC2BC9E175A727A21781CD834FEBF5590DF233E31B105E6EA29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5836 created 1708	5836	8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283.exe	81

Executes dropped EXE 2 IoCs

pid	Process
252	SecurityHealthService.exe
1196	SecurityHealthService.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\SecurityHealthService.exe\" --rkt"	8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\SecurityHealthService.exe\" --rkt"	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\SecurityHealthService.exe\" --rkt"	SecurityHealthService.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
124	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
124	cmd.exe
1300	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1300	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5168	schtasks.exe
6052	schtasks.exe
2168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5836	8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283.exe
5836	8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283.exe
5836	8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283.exe
5836	8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1196	SecurityHealthService.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 2168	5836	8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283.exe	88
PID 5836 wrote to memory of 252	5836	8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283.exe	91
PID 5836 wrote to memory of 124	5836	8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283.exe	92
PID 252 wrote to memory of 5168	252	SecurityHealthService.exe	94
PID 124 wrote to memory of 1300	124	cmd.exe	96
PID 1196 wrote to memory of 6052	1196	SecurityHealthService.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1708
- C:\Users\Admin\AppData\Local\Temp\8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283.exe
  "C:\Users\Admin\AppData\Local\Temp\8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "SecurityHealthService" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\SecurityHealthService.exe --rkt" /sc onlogon /rl limited /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2168
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C ping 127.0.0.1 -n 1 > nul & del /F /Q "C:\Users\Admin\AppData\Local\Temp\8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283.exe"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:124
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1300
- C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\SecurityHealthService.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\SecurityHealthService.exe" --rkt
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:252
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "SecurityHealthService" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\SecurityHealthService.exe --rkt" /sc onlogon /rl limited /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5168

C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\SecurityHealthService.exe
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\SecurityHealthService.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "SecurityHealthService" /tr "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\SecurityHealthService.exe --rkt" /sc onlogon /rl limited /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityHealthService.exe

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\SecurityHealthService.exe
Size 4.5MB
SHA256 8c1654ad1df9e9bf1c450657b12eb269d999934b83bbfdd59cbb886c6550f283
MD5 8c82496049dd65950f842b02171b32c0
SHA1 c79f3ffc6e55121710bcb850f3e6e9d20b0eba61
SHA512 ef5695178ec3a70c9e0573670d68d6631454dd87f0780c77ae8a7829524630552178300ad6148995b458723ad2aa18c050053456bc89a1f912e2d7f3ee592627
SSDEEP 98304:Z1DLMVtjANF8oC4xEyrTVYm8bILHGWCv5IjjPmgDfwxfH+YEO:Z1XUWXC4xEXegv5IjjPmgDfOfH7EO
TLSH
T1D4268D43D65291E9C02BC2BC9E175A727A21781CD834FEBF5590DF233E31B105E6EA29
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads