56d0e2bcf03e7e61febe1ffb51a25661e679e9951a2f64b93d8ecd5eb53b50ee

General

Target
56d0e2bcf03e7e61febe1ffb51a25661e679e9951a2f64b93d8ecd5eb53b50ee.exe
Size 603KB
Sample260910-xranpsfp7y
SHA256 56d0e2bcf03e7e61febe1ffb51a25661e679e9951a2f64b93d8ecd5eb53b50ee
MD5 13e0f631fdccc21a1e551aad88bfb049
SHA1 12abf90ac063d969f5128f6ee16fa60b92452edd
SHA512 43a78b21e105e0b3f3a46258a7aa93a9c6074a9e6931e341cf9a1b29acbfac1fffa4cda21133ba50ef4a025f28bdf0be7f6de888188e2b70abb894a58f72cf7b
SSDEEP 12288:gNGG3U3ITEmUbqLELYDqBBTh94nbqCKNA:eAIAmUbqokmBSqCUA
TLSH
T177D4D155FAA414F9E273C17CCD634602DB727CAA0770A7CB13A48A962F239D49E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5068	SecurityHealthSystray.exe
3772	GoogleUpdateCore.exe
4868	SecurityHealthSystray.exe
8	DeviceSyncHost.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ip-api.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4692	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4332	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4332	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4444	schtasks.exe
3380	schtasks.exe
3124	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 1552	4312	56d0e2bcf03e7e61febe1ffb51a25661e679e9951a2f64b93d8ecd5eb53b50ee.exe	87
PID 4312 wrote to memory of 3380	4312	56d0e2bcf03e7e61febe1ffb51a25661e679e9951a2f64b93d8ecd5eb53b50ee.exe	89
PID 4312 wrote to memory of 3392	4312	56d0e2bcf03e7e61febe1ffb51a25661e679e9951a2f64b93d8ecd5eb53b50ee.exe	91
PID 4312 wrote to memory of 3124	4312	56d0e2bcf03e7e61febe1ffb51a25661e679e9951a2f64b93d8ecd5eb53b50ee.exe	93
PID 4312 wrote to memory of 4288	4312	56d0e2bcf03e7e61febe1ffb51a25661e679e9951a2f64b93d8ecd5eb53b50ee.exe	95
PID 4312 wrote to memory of 4444	4312	56d0e2bcf03e7e61febe1ffb51a25661e679e9951a2f64b93d8ecd5eb53b50ee.exe	97
PID 4312 wrote to memory of 5068	4312	56d0e2bcf03e7e61febe1ffb51a25661e679e9951a2f64b93d8ecd5eb53b50ee.exe	99
PID 4312 wrote to memory of 4692	4312	56d0e2bcf03e7e61febe1ffb51a25661e679e9951a2f64b93d8ecd5eb53b50ee.exe	100
PID 4692 wrote to memory of 4332	4692	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\56d0e2bcf03e7e61febe1ffb51a25661e679e9951a2f64b93d8ecd5eb53b50ee.exe
"C:\Users\Admin\AppData\Local\Temp\56d0e2bcf03e7e61febe1ffb51a25661e679e9951a2f64b93d8ecd5eb53b50ee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:1552
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240662437.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3380
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:3392
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240662765.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3124
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:4288
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240663125.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4444
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240663328.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4332

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
PID:3772

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:4868

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Network Configuration Discovery

2

T1016

Internet Connection Discovery

2

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 615KB
SHA256 33d37940ac4b3de348d1c47586c1b0b586ee41845b7f3b5a2600ae7fea407a29
MD5 34e6b5b27cbde66a2369a4b5f2d7d4f1
SHA1 fb5c0540e6c7db0bdc7a0e021af74fdc0703e74f
SHA512 2fbbf830dbb55d8bfee82483cf47cab5a1018d956cbcd1ca744489ab952a19e74b0bb7e15c721ef77d02cb1d0a272f425b3f8a5e1cbdf8e4468c2651f26d3dd4
SSDEEP 12288:TNGG3U3ITEmUbqLELTHqBBTh94nbqCKNiWU:nAIAmUbqofKBSqCUiWU
TLSH
T11DD4C015FAA414F9E177C17CCD634602DB727CAA0770ABCB13A489962F23AD49E3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 643KB
SHA256 6c43c64429ed6f70f461023c265bb94bba934fc680504c9bc09fbd0563f7eff9
MD5 5eaaa0aeddecc736de63a4b7ca093549
SHA1 737d3839016e490f0c1c49230dca41adf022aa78
SHA512 4866a221958a9b56cbb834a9c6afc7d1d688ffa51f37b7e4843f4cda43fc3ef00d88be89c9c15511c8345bd19ac89a85b40cd82726fb96429aecf04446432c07
SSDEEP 12288:MNGG3U3ITEmUbqLELsUqBBTh94nbqCKNTO:aAIAmUbqoIVBSqCUTO
TLSH
T127E4D015FAA414F9E277C17CCD634602DB727C9A0770A7CB13A48A961F23AD49E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_task_240662437.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240662437.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240662765.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240662765.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240663125.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240663125.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240663328.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240663328.bat
Size 229B
SHA256 fff7af6ca734d05038cc233717dd0f561e594c7a43e5324602972bd0a10c0359
MD5 8932de503429f50da1a3cc6be0567b85
SHA1 6907d942a24cd837848f1ec60c7d60a1095ddd31
SHA512 820b6df06c032df17e2e5f902aa54336b4284bbd99d65318391eae4b763fd8f0ac9e9186d42a4213afa16fa38f7441ec3b7d753cbb5cf49387db6f86d1b1adad
TLSH
T1AED097038389863905148083666A920CC9B8C88F6B807782021681490306689BCE63C1
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 633KB
SHA256 f17c1d6773f2e4cf251ff3651696330ff4eecd8e0e483c28a7d6ee0f8036f33d
MD5 defba9d2ec72150ff9aeab1fbb5a451b
SHA1 b102d3d0fcd226791eed25f181baea752fc5c185
SHA512 e73b701abd6a4683a912a66bf2d8056061e868f413840ca9048d0c9a9095ea4666e0ffc172b9664e9fcc7fbd36d3ee677f376089d58dc38e2086f784799b2b88
SSDEEP 12288:yNGG3U3ITEmUbqLELdTqBBTh94nbqCKNlsIDk:MAIAmUbqoB2BSqCUmh
TLSH
T1EFD4D055FAA814F9E277C17CCD634602EB727C5A07B0A7CB13A44A961F23AD09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads