658553ecc9631400e23f4a3ab88b8dd1f101a1e0d5bb61c434d332878a52c64d

Analysis

max time kernel
16s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
11-01-2021 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

512KB
MD5

299e51e32a764ec12716fa4f5ee41fb0
SHA1

71c0a42ae41a86e0f6f8a1d11a358be80a9ac72b
SHA256

658553ecc9631400e23f4a3ab88b8dd1f101a1e0d5bb61c434d332878a52c64d
SHA512

b6d57a4915447dc2d2bfc1368f9edbfb0fd8d37ab8395f9d5e9507bbc78f93a61bb597afdd6aa051256d8b80884c5fd29cb4bb6791d62bc3b4aa035a4e2395bb

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

2608 powershell.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

file.exepowershell.exe

pid process

60 file.exe
60 file.exe
2608 powershell.exe
2608 powershell.exe
2608 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

file.exepowershell.exe

description pid process

Token: SeDebugPrivilege 60 file.exe
Token: SeDebugPrivilege 2608 powershell.exe

pid	process
2608	powershell.exe

pid	process
60	file.exe
60	file.exe
2608	powershell.exe
2608	powershell.exe
2608	powershell.exe

description	pid	process
Token: SeDebugPrivilege	60	file.exe
Token: SeDebugPrivilege	2608	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

file.exe

description	pid	process	target process
PID 60 wrote to memory of 2608	60	file.exe	powershell.exe
PID 60 wrote to memory of 2608	60	file.exe	powershell.exe
PID 60 wrote to memory of 2608	60	file.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:60

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\file.exe'
2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/60-2-0x0000000073AD0000-0x00000000741BE000-memory.dmp

Filesize
6.9MB

Download
memory/60-3-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/60-5-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/60-6-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/60-7-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/2608-8-0x0000000000000000-mapping.dmp

Download
memory/2608-9-0x0000000073AD0000-0x00000000741BE000-memory.dmp

Filesize
6.9MB

Download
memory/2608-10-0x0000000007210000-0x0000000007211000-memory.dmp

Filesize
4KB

Download
memory/2608-11-0x00000000079A0000-0x00000000079A1000-memory.dmp

Filesize
4KB

Download
memory/2608-12-0x0000000007930000-0x0000000007931000-memory.dmp

Filesize
4KB

Download
memory/2608-13-0x0000000008040000-0x0000000008041000-memory.dmp

Filesize
4KB

Download
memory/2608-15-0x0000000008120000-0x0000000008121000-memory.dmp

Filesize
4KB

Download
memory/2608-16-0x00000000086D0000-0x00000000086D1000-memory.dmp

Filesize
4KB

Download
memory/2608-17-0x0000000008C70000-0x0000000008C71000-memory.dmp

Filesize
4KB

Download
memory/2608-18-0x00000000089D0000-0x00000000089D1000-memory.dmp

Filesize
4KB

Download
memory/2608-19-0x000000000A150000-0x000000000A151000-memory.dmp

Filesize
4KB

Download
memory/2608-20-0x00000000096B0000-0x00000000096B1000-memory.dmp

Filesize
4KB

Download
memory/2608-21-0x0000000009AD0000-0x0000000009AD1000-memory.dmp

Filesize
4KB

Download
memory/2608-22-0x0000000007560000-0x0000000007561000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads