5ccfe0d56d9508ecf410168ce6c235f8a50f969ed867decff17f1183107d0421

General

Target
5ccfe0d56d9508ecf410168ce6c235f8a50f969ed867decff17f1183107d0421.exe
Size 728KB
Sample260910-y1ppnaee79
SHA256 5ccfe0d56d9508ecf410168ce6c235f8a50f969ed867decff17f1183107d0421
MD5 fbbfdc8bb5b791b215b2fb710753bfe2
SHA1 bc48ccf3ca875c503687e915ceaaa53e383797cd
SHA512 d8053c341190fe2c92b5774158cdc7f6dd91b9b456033f4b8567ca06a069db0c3994bec65166a41d1eaa5f063cf2e4ebeeaa9e7671ea7ea3d5c65999b8f3f9eb
SSDEEP 12288:gNGG3U3ITEmUbqLELp2/RMSCbQoXyZ42R0oETr3evXd21tP:eAIAmUbqo12RMQJZ42RPEr3ev01J
TLSH
T13EF4E115F7A810F9E273C17CCD634501EAB27C5A47A1ABDF13A449962F23AD09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
872	SecurityHealthSystray.exe
116	SecurityHealthSystray.exe
4588	DeviceSyncHost.exe
2084	GoogleUpdateCore.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ip-api.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4484	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1232	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1232	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4152	schtasks.exe
2364	schtasks.exe
3584	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 1104	3624	5ccfe0d56d9508ecf410168ce6c235f8a50f969ed867decff17f1183107d0421.exe	87
PID 3624 wrote to memory of 4152	3624	5ccfe0d56d9508ecf410168ce6c235f8a50f969ed867decff17f1183107d0421.exe	90
PID 3624 wrote to memory of 4636	3624	5ccfe0d56d9508ecf410168ce6c235f8a50f969ed867decff17f1183107d0421.exe	92
PID 3624 wrote to memory of 2364	3624	5ccfe0d56d9508ecf410168ce6c235f8a50f969ed867decff17f1183107d0421.exe	94
PID 3624 wrote to memory of 3308	3624	5ccfe0d56d9508ecf410168ce6c235f8a50f969ed867decff17f1183107d0421.exe	96
PID 3624 wrote to memory of 3584	3624	5ccfe0d56d9508ecf410168ce6c235f8a50f969ed867decff17f1183107d0421.exe	98
PID 3624 wrote to memory of 872	3624	5ccfe0d56d9508ecf410168ce6c235f8a50f969ed867decff17f1183107d0421.exe	100
PID 3624 wrote to memory of 4484	3624	5ccfe0d56d9508ecf410168ce6c235f8a50f969ed867decff17f1183107d0421.exe	101
PID 4484 wrote to memory of 1232	4484	cmd.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5ccfe0d56d9508ecf410168ce6c235f8a50f969ed867decff17f1183107d0421.exe
"C:\Users\Admin\AppData\Local\Temp\5ccfe0d56d9508ecf410168ce6c235f8a50f969ed867decff17f1183107d0421.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\AppID\PolicyConverter"
  2⤵
  PID:1104
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\AppID\PolicyConverter" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240693109.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4152
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Google\Update\CrashReportTask"
  2⤵
  PID:4636
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Google\Update\CrashReportTask" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240693421.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2364
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Query /TN "Microsoft\Windows\DeviceSync\Routine"
  2⤵
  PID:3308
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "Microsoft\Windows\DeviceSync\Routine" /XML "C:\Users\Admin\AppData\Local\Temp\svc_task_240693765.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3584
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe"
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "C:\Users\Admin\AppData\Local\Temp\\~ssclean_240693937.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1232

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
PID:116

C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
1⤵
- Executes dropped EXE
PID:4588

C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
1⤵
- Executes dropped EXE
PID:2084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Network Configuration Discovery

2

T1016

Internet Connection Discovery

2

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\DeviceSyncHost.exe
Size 755KB
SHA256 2096155b5e5b1c4f13ae780a8779a348631697e8102f91f3dbc7c80d06379472
MD5 127e33df252774eaf9332de4492e664c
SHA1 7b1a6800f2658b5e6f05e9ae448dc434d8d1427f
SHA512 f3cd6cdfa6911870ce1526e4fb16c72fdc23e244bed0898be0207d2377eb378ed0970894680d3cee451b456e4bea21786e11a880a7d568b33a71f7c11ec277d7
SSDEEP 12288:OvNGG3U3ITEmUbqLELhfifMflfKTpXfh/RMSCbQoXyZ42R0oETr3evXd21t1Do:IAIAmUbqoGHRMQJZ42RPEr3ev01Do
TLSH
T176F4F115FBA810F9E273817CCE634601EA727C5A47A1ABDF13A449962F336D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleUpdateCore.exe

Path C:\Users\Admin\AppData\Local\Google\CrashReports\GoogleUpdateCore.exe
Size 779KB
SHA256 052f24ecd780e10ceed363234d8b0af59852d4537bcb8b63c1e90aeb305db85b
MD5 1212604f552c96aa7f0314fd173c91c7
SHA1 597dc2515063fb6916699f7cff6192111f8b7505
SHA512 c6cee575eb12930632f204574572892e3cb94baac93eba6e7c3305a51c6098bb1be8e58d5e82059e08a34fbe6ebaf9dd21bd4230a263d586a5c7ed1c26461d67
SSDEEP 12288:rNGG3U3ITEmUbqLEL/P/RMSCbQoXyZ42R0oETr3evXd21tMinr/Q:PAIAmUbqojnRMQJZ42RPEr3ev01K
TLSH
T11B05F114F7A814F9E273C17CCD634601EAB27C5A47A19BDF13A48A962F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_task_240693109.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240693109.xml
Size 1KB
SHA256 1d201e874e9c83f2c891cd43592e53bd692070d2bf005a3ba6e0296fb83c6311
MD5 b9f69c0cc0b3ab0c5071c993adedd59f
SHA1 e97d95eb9bb05f8532f295e5d425d00186029a60
SHA512 d3dc41d39d1907f9f6066205c091f131878f2c17c2253a5bb3a05f38c7d7c19e4c261c23ea36befb91eeff4206b7993a3e2e0bb1cd3229c3efa18d2ef08058fd
TLSH
T13241424367FA1209F2F36B6CAA7604219E67BC515C39D46C01AC240CCAF3C62D8717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240693421.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240693421.xml
Size 1KB
SHA256 63a29abf4336e23241639f0d3d53cfe6bafeb44f5cac9698b62d6a517e5e1cae
MD5 c849fab85a21721a4dd80a0f36cb8ffe
SHA1 fc1345647d1a91ee1b89a1e6e9fcd9714bb4b087
SHA512 2f635e35645c1e6fac779494dc22b2085685cb2a18c4564155b424319433cf9005dd6cc71d1f4f026d06e02ae1dd5d7dfd7db370fe20d51dc0a2048ac2f1840e
TLSH
T14241354367FA1209F2F76B6CAA7610219E67BC555C39D46C01AC240CCAF3C62D9717B7
MD5 SHA1 SHA512 TLSH

Submit Download

svc_task_240693765.xml

Path C:\Users\Admin\AppData\Local\Temp\svc_task_240693765.xml
Size 1KB
SHA256 efa3e9e63edc75d28018b0061f43cb06c57bb67ae2702a7c250be34ef6eb0bc4
MD5 e6b9c21a28dcfd64301e96c271e02cf3
SHA1 d134f2433189d690340add7a829d8a6e89149737
SHA512 50f7f3fc975f027aa54ab551866af2e0e4fbf67d01a60565b2a8684609dcf19d3699fca32fbad6d92305b3de346294ea5d4c3bc4ad52febe32c1e6c948c45d6c
TLSH
T13341324367FE1219F2F36BACAA7604219E67BC555C39D46C11BC240CCAF3C6298A17B7
MD5 SHA1 SHA512 TLSH

Submit Download

~ssclean_240693937.bat

Path C:\Users\Admin\AppData\Local\Temp\~ssclean_240693937.bat
Size 229B
SHA256 7bbae584f333116d59f6a3d77a7d5e525eb588dcb8db627394c75a3f1971e280
MD5 7b5c863f40c46a40878cc93bcd47810c
SHA1 62033fc4bd671c9685106d1e1766ea4cafc8f3a4
SHA512 647f69dbe0070db82c8ad419347d3619fb0f618536a09cf38fa4f220d59ae9de2ce013d3e407576c7be24b188d005e157e076a5e956cd42d7d187919b310b2e1
TLSH
T1E2D09783928981A40505A8D38069A30C82A4C90D2F80BFC7023090CE221A5A6F1A72C0
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 739KB
SHA256 18d85d42d5ff575a6adcc1e1c38391835b2bd287456af3670a98b7515bba7f9f
MD5 d77b2a47072d2e3124b7496a85c287aa
SHA1 62fc3dbeaa2dcd1ef937bdfd8ad6574a4a079bce
SHA512 9a2fc345788cfb78a1ef8f9d84735d2afcb6a8f536fe30e809bbbf3f08b64042c9a13528d539cd60e35f60029724cf31f284841297b60994f79edc3d2165b495
SSDEEP 12288:xNGG3U3ITEmUbqLELuO/RMSCbQoXyZ42R0oETr3evXd21ts:xAIAmUbqoSORMQJZ42RPEr3ev01C
TLSH
T170F4E115FBA810F9E273C17CCD634601EA727C5A47A1ABDF13A489962F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads