Analysis
-
max time kernel
596s -
max time network
596s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
23-11-2020 12:02
Static task
static1
General
-
Target
f0b83514c6f826e695fb34c8264f54e528d355c0765fdcd5f9c3c0e3d6127f54.ps1
-
Size
171B
-
MD5
d5572751f440766c4c24f20aeb4a368f
-
SHA1
b4556e63d3b4307878e51d5dfab5ea3a4e9e7946
-
SHA256
f0b83514c6f826e695fb34c8264f54e528d355c0765fdcd5f9c3c0e3d6127f54
-
SHA512
19b2c56b04e266df5773c727d3d0137e6e024662286b39d6825c93718c5f93850f0a0536868a9bae72472d92eb00f14512b28cfcb823d737d1c7eabe5f4cbccc
Malware Config
Extracted
trickbot
100003
tar3
102.164.206.129:449
103.131.156.21:449
103.131.157.102:449
103.131.157.161:449
103.146.232.5:449
103.150.68.124:449
103.156.126.232:449
103.30.85.157:449
103.52.47.20:449
-
autorunName:pwgrab
Signatures
-
Blacklisted process makes network request 2 IoCs
Processes:
powershell.execmd.exeflow pid process 6 1580 powershell.exe 46 1440 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
_104579.exepid process 1416 _104579.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18 checkip.amazonaws.com -
Modifies service 2 TTPs 2 IoCs
Processes:
ipconfig.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas ipconfig.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs ipconfig.exe -
Discovers systems in the same network 1 TTPs 2 IoCs
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1004 ipconfig.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.execmd.execmd.exepid process 1580 powershell.exe 348 cmd.exe 1440 cmd.exe 348 cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exewermgr.execmd.exedescription pid process Token: SeDebugPrivilege 1580 powershell.exe Token: SeDebugPrivilege 268 wermgr.exe Token: SeDebugPrivilege 348 cmd.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
_104579.exepid process 1416 _104579.exe 1416 _104579.exe 1416 _104579.exe 1416 _104579.exe -
Suspicious use of WriteProcessMemory 718 IoCs
Processes:
powershell.exe_104579.exewermgr.exedescription pid process target process PID 1580 wrote to memory of 1416 1580 powershell.exe _104579.exe PID 1580 wrote to memory of 1416 1580 powershell.exe _104579.exe PID 1580 wrote to memory of 1416 1580 powershell.exe _104579.exe PID 1580 wrote to memory of 1416 1580 powershell.exe _104579.exe PID 1416 wrote to memory of 268 1416 _104579.exe wermgr.exe PID 1416 wrote to memory of 268 1416 _104579.exe wermgr.exe PID 1416 wrote to memory of 268 1416 _104579.exe wermgr.exe PID 1416 wrote to memory of 268 1416 _104579.exe wermgr.exe PID 1416 wrote to memory of 268 1416 _104579.exe wermgr.exe PID 1416 wrote to memory of 268 1416 _104579.exe wermgr.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe PID 268 wrote to memory of 348 268 wermgr.exe cmd.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\f0b83514c6f826e695fb34c8264f54e528d355c0765fdcd5f9c3c0e3d6127f54.ps11⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_104579.exe"C:\Users\Admin\AppData\Local\Temp\_104579.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe4⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ipconfig.exeipconfig /all5⤵
- Modifies service
- Gathers network information
-
C:\Windows\system32\net.exenet config workstation5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 config workstation6⤵
-
C:\Windows\system32\net.exenet view /all5⤵
- Discovers systems in the same network
-
C:\Windows\system32\net.exenet view /all /domain5⤵
- Discovers systems in the same network
-
C:\Windows\system32\nltest.exenltest /domain_trusts5⤵
-
C:\Windows\system32\nltest.exenltest /domain_trusts /all_trusts5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_104579.exeMD5
c252603232987121f642be93e9e39348
SHA19a06574b7f9f732cf6265fe0aff4c133c1cb8314
SHA25677b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3
SHA51270630a8d2c467a6fed99443da2a776c67b6f819c58f5c77d6af8e441a53c891eb169c27a5ee4b5f799d3d51df922d9688d1f4edd55aa6b094d1422291681dc7e
-
C:\Users\Admin\AppData\Local\Temp\_104579.exeMD5
c252603232987121f642be93e9e39348
SHA19a06574b7f9f732cf6265fe0aff4c133c1cb8314
SHA25677b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3
SHA51270630a8d2c467a6fed99443da2a776c67b6f819c58f5c77d6af8e441a53c891eb169c27a5ee4b5f799d3d51df922d9688d1f4edd55aa6b094d1422291681dc7e
-
memory/268-11-0x0000000000000000-mapping.dmp
-
memory/316-101-0x0000000000000000-mapping.dmp
-
memory/348-106-0x0000000000130000-0x0000000000130010-memory.dmpFilesize
16B
-
memory/348-26-0x0000000000130000-0x0000000000130010-memory.dmpFilesize
16B
-
memory/348-25-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/348-13-0x0000000000000000-mapping.dmp
-
memory/1004-94-0x0000000000000000-mapping.dmp
-
memory/1324-96-0x0000000000000000-mapping.dmp
-
memory/1416-7-0x0000000000000000-mapping.dmp
-
memory/1416-10-0x00000000004F0000-0x000000000052A000-memory.dmpFilesize
232KB
-
memory/1416-9-0x00000000004B0000-0x00000000004EE000-memory.dmpFilesize
248KB
-
memory/1440-62-0x0000000000340000-0x000000000034000D-memory.dmpFilesize
13B
-
memory/1440-93-0x0000000001B80000-0x0000000001B80188-memory.dmpFilesize
392B
-
memory/1440-105-0x0000000000340000-0x000000000034000D-memory.dmpFilesize
13B
-
memory/1440-48-0x0000000000000000-mapping.dmp
-
memory/1440-56-0x0000000180000000-0x0000000180016000-memory.dmpFilesize
88KB
-
memory/1440-58-0x0000000180000000-0x0000000180016000-memory.dmpFilesize
88KB
-
memory/1440-59-0x0000000001BB0000-0x0000000001BB0080-memory.dmpFilesize
128B
-
memory/1440-61-0x0000000000350000-0x0000000000350400-memory.dmpFilesize
1024B
-
memory/1440-103-0x0000000001B80000-0x0000000001B80188-memory.dmpFilesize
392B
-
memory/1580-6-0x0000000002990000-0x0000000002991000-memory.dmpFilesize
4KB
-
memory/1580-4-0x0000000001D50000-0x0000000001D51000-memory.dmpFilesize
4KB
-
memory/1580-3-0x0000000002650000-0x0000000002651000-memory.dmpFilesize
4KB
-
memory/1580-2-0x000000001AD10000-0x000000001AD11000-memory.dmpFilesize
4KB
-
memory/1580-0-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmpFilesize
9.9MB
-
memory/1580-5-0x000000001C480000-0x000000001C481000-memory.dmpFilesize
4KB
-
memory/1580-1-0x00000000022A0000-0x00000000022A1000-memory.dmpFilesize
4KB
-
memory/1680-97-0x0000000000000000-mapping.dmp
-
memory/1832-98-0x0000000000000000-mapping.dmp
-
memory/1916-99-0x0000000000000000-mapping.dmp
-
memory/2016-102-0x0000000000000000-mapping.dmp