b89a70f1b581bb4807cb6a7c40146f0b28e2f1469c83bd019c1a37819da85a79

Analysis

max time kernel
66s
max time network
70s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 18:53

Target

wxipp.exe
Size

182KB
MD5

7d8f1fc0c5e1d7ca23385a823024c959
SHA1

fb50e723d2cfe73c7ec55ee24cd5d1dffa2a5245
SHA256

b89a70f1b581bb4807cb6a7c40146f0b28e2f1469c83bd019c1a37819da85a79
SHA512

5e060910f9df45be168b1c6a6423f029ed360667d270aab317efc00cd3ef60e9bfd09c572b15b1ebd3d40b1b01a36e3fdb925713c0a006e76e08360f0cbc2b29
SSDEEP

3072:M9ocHuUrOkFV1qGjTHfVMMQfrwHn0/Mp+Z3zDBmLjqZ9NRbqzJxlNszz1:MKcHuydHNMbfrwH0/dZRmLjqZ9NRbqF0

Score

6^/10

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

wxipp.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wxipp.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1756 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

wxipp.exe

pid process

2216 wxipp.exe
2216 wxipp.exe
2216 wxipp.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

wxipp.exe

pid process

2216 wxipp.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

wxipp.exe

description pid process

Token: SeDebugPrivilege 2216 wxipp.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wxipp.exe

pid	process
1756	schtasks.exe

pid	process
2216	wxipp.exe

description	pid	process
Token: SeDebugPrivilege	2216	wxipp.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

wxipp.exe

description	pid	process	target process
PID 2216 wrote to memory of 2664	2216	wxipp.exe	schtasks.exe
PID 2216 wrote to memory of 2664	2216	wxipp.exe	schtasks.exe
PID 2216 wrote to memory of 2664	2216	wxipp.exe	schtasks.exe
PID 2216 wrote to memory of 2664	2216	wxipp.exe	schtasks.exe
PID 2216 wrote to memory of 1756	2216	wxipp.exe	schtasks.exe
PID 2216 wrote to memory of 1756	2216	wxipp.exe	schtasks.exe
PID 2216 wrote to memory of 1756	2216	wxipp.exe	schtasks.exe
PID 2216 wrote to memory of 1756	2216	wxipp.exe	schtasks.exe

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /delete /f /tn "Microsoft\Windows\Client Server Runtime Process"
2⤵
PID:2664

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "Microsoft\Windows\Client Server Runtime Process" /xml "C:\Users\Admin\AppData\Local\Temp\tmp15B2.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Users\Admin\AppData\Local\Temp\tmp15B2.tmp
Filesize
1KB

MD5
161a228bbffc66c3ecaff78b2ca5e6ba

SHA1
d9559ecf4ee35e58405b05f88759c705cdb2ac06

SHA256
e56a6fb81d329006e80a7fa324455ef08101450f62551d93c93b0079abc850a0

SHA512
61bcd916404f2feccf824845e93c9d9f6cdfae52785e50cc94217f87a2e3162a494ac5d29676b6322a80940614bf0aab922f124cccca7f23cc6fc1485a94e106

Download Submit
memory/2216-0-0x0000000074631000-0x0000000074632000-memory.dmp

Filesize
4KB

Download
memory/2216-1-0x0000000074630000-0x0000000074BDB000-memory.dmp

Filesize
5.7MB

Download
memory/2216-2-0x0000000074630000-0x0000000074BDB000-memory.dmp

Filesize
5.7MB

Download
memory/2216-6-0x0000000074630000-0x0000000074BDB000-memory.dmp

Filesize
5.7MB

Download
memory/2216-7-0x0000000074630000-0x0000000074BDB000-memory.dmp

Filesize
5.7MB

Download
memory/2216-8-0x0000000074630000-0x0000000074BDB000-memory.dmp

Filesize
5.7MB

Download
memory/2216-9-0x0000000074630000-0x0000000074BDB000-memory.dmp

Filesize
5.7MB

Download