Overview

overview

10

Static

static

e1650d31f0...cc.ps1

windows7_x64

8

e1650d31f0...cc.ps1

windows10-2004_x64

10

Analysis

  • max time kernel
    117s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    01-02-2022 01:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e1650d31f00d38b98cf8aa48a2e5fdd4bb30dd1177546abe3053bdcff25cefcc.ps1

  • Size

    5.1MB

  • MD5

    b49b3852097431b773e6dcf4c314f87a

  • SHA1

    f0952ec5d3c90398e1335f1fad00b80dbd4c5a32

  • SHA256

    e1650d31f00d38b98cf8aa48a2e5fdd4bb30dd1177546abe3053bdcff25cefcc

  • SHA512

    0274aa4b490f226174fb5ea9f993ad38431438846313fde54682ef69a73fbebb26e51bf2f8b3e5fc604dab6e765765f5fd1d6f6bfefb928cb8a2f5ac33561291

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Drops file in Windows directory 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1380
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\e1650d31f00d38b98cf8aa48a2e5fdd4bb30dd1177546abe3053bdcff25cefcc.ps1
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1584
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q7a37ulc.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:556
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD827.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD826.tmp"
            4⤵
              PID:1296
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\osezxfjq.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1428
            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE6C7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE6C6.tmp"
              4⤵
                PID:540
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1764
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1760

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/556-62-0x0000000000420000-0x00000000009D0000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/1380-80-0x0000000002690000-0x00000000026A2000-memory.dmp

          Filesize

          72KB

          Download

        • memory/1380-81-0x0000000002690000-0x00000000026A2000-memory.dmp

          Filesize

          72KB

          Download

        • memory/1584-59-0x00000000027BB000-0x00000000027DA000-memory.dmp

          Filesize

          124KB

          Download

        • memory/1584-58-0x00000000027B4000-0x00000000027B7000-memory.dmp

          Filesize

          12KB

          Download

        • memory/1584-57-0x00000000027B2000-0x00000000027B4000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1584-56-0x00000000027B0000-0x00000000027B2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1584-54-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1584-55-0x000007FEF31E0000-0x000007FEF3D3D000-memory.dmp

          Filesize

          11.4MB

          Download

        • memory/1764-83-0x0000000004150000-0x0000000004151000-memory.dmp

          Filesize

          4KB

          Download